Where do calendar messages in PST files store appointment times and dates?

Question

I am using the PST File Format SDK to try and extract some appointment item data from an Outlook PST export:

int main()
{
    pst myfile(L"export.pst");
    folder calendar = myfile.open_folder(L"Calendar");
    for (folder::message_iterator msg = calendar.message_begin(); msg != calendar.message_end(); ++msg)
    {
        message m = *msg;
        wstring subject = L"";
        if (m.has_subject())
            subject = m.get_subject();
        wstring body = L"";
        if (m.has_body())
            body = m.get_body();
        wstring htmlbody = L"";
        if (m.has_html_body())
            htmlbody = m.get_html_body();
        size_t num_attachments = m.get_attachment_count();
        size_t num_recipients = m.get_recipient_count();
        property_bag bag = m.get_property_bag();
        vector<prop_id> propertyList = bag.get_prop_list();
        for (vector<prop_id>::iterator prop = propertyList.begin(); prop != propertyList.end(); ++prop)
        {
            if (bag.get_prop_type(*prop) == prop_type_systime)
                FILETIME property = bag.read_prop<FILETIME>(*prop);
        }
        break; // Just try the first message for now.
    }
    return 0;
}

How does Outlook store appointment data? I mean, how can I get at the very least the appointment start time and duration (or end time)? I've been trying to scour the PST file format specification from Microsoft but I can't seem to find this information I need!

Edit: I can parse FILETIME objects as in the above code now, but the question is, how can I distinguish them to what time they are referring to? I mean, how can I tell if this is the time of the event date, or the end of the event date, etc.? They should have names to distinguish them, should they not? How do I get that using pstsdk?

score 2 · Answer 1 · edited Apr 30 '22 at 05:04

2

These (and many more) properties are stored as named MAPI properties. Their tags will vary between different stores, so you cannot hardcode them. See the explanation of what named properties are on my web site: https://www.dimastr.com/redemption/utils.htm#named-props

Take a look at an existing appointment in OutlookSpy (I am its author) - click IMessage button.

edited Apr 30 '22 at 05:04

Ryan M

18,333
31
67
74

answered Jul 06 '16 at 20:54

Dmitry Streblechenko

62,942
4
53
78

Thanks I will have a look via your utility application, but what data type is this type of property stored as? In my code above I iterate through the message property list - is that the same as what you mean by MAPI properties? Because I am casting to `wstring` it is surely throwing exceptions for all other properties that are not `wstring`, making it hard for me to get the data I need – Alexandru Jul 06 '16 at 22:22
The property type is PT_SYSTIME. Definitely not a string. – Dmitry Streblechenko Jul 07 '16 at 06:47
Okay, I managed to use `pstsdk` to get properties into `FILETIME` objects: `if (bag.get_prop_type(*prop) == prop_type_systime) FILETIME property = bag.read_prop(*prop);` which works nicely; the only thing I can't seem to figure out is what the name of each date property actually is, to uniquely identify it, like you said? This SDK is a bit odd, and I am not sure how to get the name of a property. – Alexandru Jul 08 '16 at 17:49
You need to look at the property tags. On the MAPI level the property tag (unique to a particular store) for a named property (>=0x80000000, shown in bold by OutlookSpy) is returned by a call to IMAPIProp::GetIDsFromNames passing the GUID and id of the property(take a look at an appointment using OutlookSpy). I don't know how these particular library handles named properties. – Dmitry Streblechenko Jul 08 '16 at 18:32
It looks like these properties are not actually named properties, but instead contain a GUID and an ID which map to a specific property which is outlined within the Exchange Server Protocols Master Property List. Microsoft documents what each GUID and ID maps to within the MS-OXPROPS document here: https://msdn.microsoft.com/en-us/library/cc433490(v=exchg.80).aspx For example, `PidLidAppointmentStartDate` which *identifies the date that the appointment starts* corresponds to GUID `{00062002-0000-0000-C000-000000000046}` and ID `0x00008212`, and it is of type `PtypTime`. – Alexandru Jul 11 '16 at 12:17
Yes, that is what a named property is. – Dmitry Streblechenko Jul 11 '16 at 14:25

Where do calendar messages in PST files store appointment times and dates?

1 Answers1