Outlook/Exchange message subheader magic bytes (.msg)
.msg file signature: D0 CF 11 E0 A1 B1 1A E1 | application/vnd.ms-outlook
Category: Email & PIM
The Outlook/Exchange message subheader is a Microsoft compound document format used within Outlook message files and other OLE-based containers. It is primarily used by Microsoft Outlook and related Exchange tools to store email messages, attachments, and metadata in a structured binary form. As a legacy Microsoft format, it may appear in older documents and mail archives, and files should still be treated cautiously when received from untrusted sources.
Magic Bytes
Offset 0
D0 CF 11 E0 A1 B1 1A E1
Sources: Wikipedia, Gary Kessler
All Known Signatures
3 signature variants are documented for .msg files across multiple sources.
| Hex Signature | Offset | Sources |
|---|---|---|
| D0 CF 11 E0 A1 B1 1A E1 | 0 | Wikipedia, Gary Kessler |
| 52 00 6F 00 6F 00 74 00 20 00 45 00 6E 00 74 00 72 00 79 00 | 512 | Gary Kessler |
| FD FF FF FF 04 | 512 | Gary Kessler |
Validation Code
How to validate .msg files in Python
def is_msg(file_path: str) -> bool:
"""Check if file is a valid MSG by magic bytes."""
signature = bytes([0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1])
with open(file_path, "rb") as f:
return f.read(8) == signatureHow to validate .msg files in Node.js
function isMSG(buffer: Buffer): boolean {
const signature = Buffer.from([0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1]);
return buffer.subarray(0, 8).equals(signature);
}How to validate .msg files in Go
func IsMSG(data []byte) bool {
signature := []byte{0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1}
if len(data) < 8 {
return false
}
return bytes.Equal(data[:8], signature)
}API Endpoint
/api/v1/msg
curl https://filesignature.org/api/v1/msg
See the full API documentation for all endpoints and parameters.
Related Formats
Frequently Asked Questions
What is a .msg file?
A .msg file is an Outlook/Exchange message subheader file. The Outlook/Exchange message subheader is a Microsoft compound document format used within Outlook message files and other OLE-based containers. It is primarily used by Microsoft Outlook and related Exchange tools to store email messages, attachments, and metadata in a structured binary form. As a legacy Microsoft format, it may appear in older documents and mail archives, and files should still be treated cautiously when received from untrusted sources.
What are the magic bytes for .msg files?
The magic bytes for Outlook/Exchange message subheader (.msg) files are D0 CF 11 E0 A1 B1 1A E1 at byte offset 0. These bytes identify the file format more reliably than the extension alone.
How do I validate a .msg file?
To validate a .msg file, read the first bytes of the file and compare them against the known magic bytes (D0 CF 11 E0 A1 B1 1A E1) at offset 0. This is more reliable than checking the file extension alone, as extensions can be renamed.
What is the MIME type for .msg files?
The primary MIME type for .msg files is application/vnd.ms-outlook.
Is it safe to open .msg files?
Outlook/Exchange message subheader (.msg) files are generally safe to open. They are classified as low risk because they primarily contain data rather than executable code. However, always ensure files come from a trusted source.