none
Tool to read msg file properties RRS feed

  • Question

  • Hi,

    I would like to know if there is any tool that can read email properties and if there is any property that will tell me if the email (in msg format, as a loose file) is marked as read or unread.

    Please let me know if this not the right forum to post this question.

    Thanks

    Miguel Henriques

    Thursday, February 11, 2016 2:03 PM

Answers

All replies

  • MFCMAPI can do what you are asking.  You can obtain it from http://mfcmapi.codeplex.com/

    You can tell if the message is read or unread by viewing the PR_MESSAGE_FLAGS property.

    Thursday, February 11, 2016 2:19 PM
  • Are you trying to do that manually (you can use OutlookSpy - click OpenImsgOnIStg button) or programmatically (Redemption exposes RDOSession.GetMessageFromMsgFile method)?

    Keep in mind however that read/unread status is not stored by the MSG files.


    Dmitry Streblechenko (MVP)
    http://www.dimastr.com/redemption
    Redemption - what the Outlook
    Object Model should have been
    Version 5.5 is now available!


    Thursday, February 11, 2016 2:50 PM
  • Do you know which property will tell me if the message is marked as read/unread?

    Thanks

    Miguel

    Thursday, February 11, 2016 3:37 PM
  • Keep in mind however that read/unread status is not stored by the MSG files.



    Dmitry,

    Using Outlook 2013 I saved an opened message and an unread message to unicode .msg files.  In both instances, the PR_MESSAGE_FLAGS property of the .msg file reflected correct values.  However, Outlook marked the unread message as having been read after the save operation.

    Thursday, February 11, 2016 3:49 PM
  • Thanks for all your answers.

    I did a couple of test exporting and importing messages from/to Outlook and the read status is kept. At least the bold is still there, for the unread emails.

    I am still trying to find the list of values that will tell me what is and what is not marked as unread. Does anyone know if such a list exists?

    I've found values for the property PidTagMessageFlags but they don't tell me exactly what I need.

    Thanks

    Miguel

    Thursday, February 11, 2016 4:56 PM
  • It looks like you are right...

    Dmitry Streblechenko (MVP)
    http://www.dimastr.com/redemption
    Redemption - what the Outlook
    Object Model should have been
    Version 5.5 is now available!

    Thursday, February 11, 2016 4:56 PM
  • Thanks for all your answers.

    I did a couple of test exporting and importing messages from/to Outlook and the read status is kept. At least the bold is still there, for the unread emails.

    I am still trying to find the list of values that will tell me what is and what is not marked as unread. Does anyone know if such a list exists?

    I've found values for the property PidTagMessageFlags but they don't tell me exactly what I need.

    Thanks

    Miguel

    It is a long value that contains a bitmask of flags.  See https://msdn.microsoft.com/en-us/library/cc839733%28v=office.15%29.aspx for an explanation of the various flags.   The one you are looking for is MSGFLAG_READ.

    Thursday, February 11, 2016 5:03 PM
  • Hi again,

    I have been trying to figure out how can I conclude that an email is marked as read or unread by looking at the PidTagMessageFlags property. I undestand that the MSGFLAG_READ is the key but when I analyse the MSG with a tool like OutlookSpy, I get diferent values for this property if the email is read or unread, with or without attach, with or without receipt, etc.

    In the link you just sent, it is written that "...with different values depending upon the client application or store provider involved". This means that I can not have a "standard" procedure to identity this, if I don't know what is the version of the email client and server? Because in the end what I need is to evaluate this property in a forensic tool (Nuix) and I don't know where the data was collected from.

    Many thanks

    Miguel

    Friday, February 19, 2016 11:53 AM
  • Hi again,

    I have been trying to figure out how can I conclude that an email is marked as read or unread by looking at the PidTagMessageFlags property. I undestand that the MSGFLAG_READ is the key but when I analyse the MSG with a tool like OutlookSpy, I get diferent values for this property if the email is read or unread, with or without attach, with or without receipt, etc.

    In the link you just sent, it is written that "...with different values depending upon the client application or store provider involved". This means that I can not have a "standard" procedure to identity this, if I don't know what is the version of the email client and server? Because in the end what I need is to evaluate this property in a forensic tool (Nuix) and I don't know where the data was collected from.

    Many thanks

    Miguel

    The PidTagMessageFlags property conveys more information than just read/unread status.  That is why the  property value is different regarding with/without attachments, receipts, etc.  MSGFLAG_READ is only one bit in the PidTagMessageFlags property.  Other bit flags in the property are also enumerated in the link I sent.

    The source of your data should advise you whether it was collected from a Microsoft Exchange Server, Outlook PST/OST or some other store provider.  The Microsoft documentations should be accurate for data provided by a Microsoft store provider.  That 's the best advice I can offer you.

    Friday, February 19, 2016 12:07 PM