{"success":true,"data":{"ext":"msg","name":"Outlook/Exchange message subheader","description":"The Outlook/Exchange message subheader is a Microsoft compound document format used within Outlook message files and other OLE-based containers. It is primarily used by Microsoft Outlook and related Exchange tools to store email messages, attachments, and metadata in a structured binary form. As a legacy Microsoft format, it may appear in older documents and mail archives, and files should still be treated cautiously when received from untrusted sources.","mime":["application/vnd.ms-outlook"],"risk_level":"Safe","signatures":[{"hex":"D0 CF 11 E0 A1 B1 1A E1","offset":0,"sources":[{"name":"Wikipedia","url":"https://en.wikipedia.org/wiki/List_of_file_signatures"},{"name":"Gary Kessler","url":"https://www.garykessler.net/library/file_sigs_GCK_latest.html"}]},{"hex":"52 00 6F 00 6F 00 74 00 20 00 45 00 6E 00 74 00 72 00 79 00","offset":512,"sources":[{"name":"Gary Kessler","url":"https://www.garykessler.net/library/file_sigs_GCK_latest.html"}]},{"hex":"FD FF FF FF 04","offset":512,"sources":[{"name":"Gary Kessler","url":"https://www.garykessler.net/library/file_sigs_GCK_latest.html"}]}],"related":["mbox","ost","pst","dbx","wab","dci"],"usage":{"python":"def is_msg(file_path: str) -> bool:\n    \"\"\"Check if file is a valid MSG by magic bytes.\"\"\"\n    signature = bytes([0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1])\n    with open(file_path, \"rb\") as f:\n        return f.read(8) == signature","node":"function isMSG(buffer: Buffer): boolean {\n  const signature = Buffer.from([0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1]);\n  return buffer.subarray(0, 8).equals(signature);\n}","go":"func IsMSG(data []byte) bool {\n    signature := []byte{0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1}\n    if len(data) < 8 {\n        return false\n    }\n    return bytes.Equal(data[:8], signature)\n}"},"category":"Email & PIM"}}