Outlook/Exchange message subheader (.msg)

.msg file signature | application/octet-stream

Compound File Binary Format, a container format defined by Microsoft COM. It can contain the equivalent of files and directories. It is used byWindows Installerand for documents in older versions ofMicrosoft Office.[44]It can be used by other programs as well that rely on the COM and OLE API's. (0xD0CF11E0visually resembles "DOCFILE".[45])

Safe

Magic Bytes

Offset 0


              D0 CF 11 E0 A1 B1 1A E1

Sources: Wikipedia, Gary Kessler

All Known Signatures

4 signature variants are documented for .msg files across multiple sources.

Hex Signature	Offset	Sources
D0 CF 11 E0 A1 B1 1A E1	0	Wikipedia, Gary Kessler
51 20 BE FF E5 00 6F 00 6F 00 74 00 20 00 45 00 6E 00 74 00 72 00 79 00	0	Gary Kessler
CF FA ED FE	0	Gary Kessler
51 20 BE FF EF FF FF FF 04	0	Gary Kessler

Extension

.msg

MIME Type

application/octet-stream

Byte Offset

Risk Level

Safe

Validation Code

How to validate .msg files in Python

Python

def is_msg(file_path: str) -> bool:
    """Check if file is a valid MSG by magic bytes."""
    signature = bytes([0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1])
    with open(file_path, "rb") as f:
        return f.read(8) == signature

How to validate .msg files in Node.js

Node.js

function isMSG(buffer: Buffer): boolean {
  const signature = Buffer.from([0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1]);
  return buffer.subarray(0, 8).equals(signature);
}

How to validate .msg files in Go

func IsMSG(data []byte) bool {
    signature := []byte{0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1}
    if len(data) < 8 {
        return false
    }
    return bytes.Equal(data[:8], signature)
}

API Endpoint

GET /api/v1/msg


              curl https://filesignature.org/api/v1/msg

See the full API documentation for all endpoints and parameters.

Frequently Asked Questions

What is a .msg file?

A .msg file is a Outlook/Exchange message subheader file. Compound File Binary Format, a container format defined by Microsoft COM. It can contain the equivalent of files and directories. It is used byWindows Installerand for documents in older versions ofMicrosoft Office.[44]It can be used by other programs as well that rely on the COM and OLE API's. (0xD0CF11E0visually resembles "DOCFILE".[45])

What are the magic bytes for .msg files?

The magic bytes for Outlook/Exchange message subheader files are D0 CF 11 E0 A1 B1 1A E1 at byte offset 0. These bytes uniquely identify the file format regardless of the file extension.

How do I validate a .msg file?

To validate a .msg file, read the first bytes of the file and compare them against the known magic bytes (D0 CF 11 E0 A1 B1 1A E1) at offset 0. This is more reliable than checking the file extension alone, as extensions can be renamed.

What is the MIME type for .msg files?

There is no officially registered MIME type for .msg files. Systems typically use application/octet-stream as a generic fallback when handling this format.

Is it safe to open .msg files?

Outlook/Exchange message subheader (.msg) files are generally safe to open. They are classified as low risk because they primarily contain data rather than executable code. However, always ensure files come from a trusted source.