Q: What is the Outlook saved mail (.msg) file format and what security problems come with its use?

A: Whether you use an Internet mail account (i.e., POP3, IMAP4) or a Microsoft Exchange Server mailbox, content of your account, such as messages, appointments, and contacts, is stored in a database. Exchange mailbox data is either the proprietary Extensible Storage Engine (ESE) database with file extension .edb on an Exchange Server or a personal folder store (.pst) on a local workstation. Many older messaging solutions, and some current ones, use individual files in a file system for mailbox item storage. In most cases, these are simple file system files, often text files, but these items can still be indexed for efficient retrieval and storage.

Microsoft offers a file format, .msg, for storing individual Outlook items in the file system; however, it's not a simple text file that you can view with a text editor such as WordPad or Notepad. These .msg files are based on Compound File Binary Format and require a MAPI-aware application to fully view the storages and streams. Microsoft sometimes refers to the .msg files as "Outlook saved mail." Some alternative messaging solutions have developed methods to import Microsoft's .msg-formatted files into their database structures, such as by using an Outlook connector tool or other utility. Third-party .msg file-manipulation tools include MSG 2 PST and MsgViewer Pro.

To create an .msg file from an Outlook item, such as an email message, you can drag-and-drop the item from an Outlook folder to a folder in Windows Explorer, as Figure 1 shows. You can also select the Save As menu option from an Outlook item, then choose a location to save the item. Either way, Outlook performs a simple export to the .msg file format during this effort.

Figure 1: Creating an .msg file from an Outlook item by dragging and dropping the item from an Outlook folder to a folder in Windows Explorer (click image for larger view)

During the export, almost 100 message and attachment properties are included in the new .msg file. (For information about the specific properties, see the MSDN article "2.2.1 Message Object Properties.") The message subject is used as the file name, with the extension .msg added. The files are saved to the file system using the current date and time when you save them, but the Outlook item within retains its date properties. You can easily drag and drop the .msg files back into Outlook folders as well, essentially stripping .msg file formatting and returning the content to Outlook. These .msg files can be indexed and searched with Windows Desktop Search with the add-in for Outlook saved mail indexing, which you can download from the Microsoft Download Center.

The Outlook item file format (.msg) provides a reasonable archive mechanism for Outlook content. However, using .msg files might not be a good thing for your company situation and policies. Users can copy content to .msg files in the file system, removing them from centrally managed storage controls. Wayward .msg files can provide cause for security concerns because content is easily copied. There's no account security on .msg files and no way to prevent users from dragging and dropping Outlook content to Windows Explorer.

There are some deterrents to the process of saving content as .msg files, but none are slam dunks in terms of prevention. You can implement file screening on Windows servers (Windows Server 2003 R2 and later) to prevent users from saving .msg files on server shares. You can also use the Office Customization Tool to set a policy removing the Save As option from the menu system when viewing items in Outlook. This option doesn't prevent a manual drag and drop, however. I've seen companies run scripts, either at logon or at intervals, that search for and remove any .msg files on the users' workstations.

If your company uses Microsoft Information Rights Management (IRM) to secure and control attachments, it should be noted that .msg files are not affected by IRM. That is, .msg files aren't a file type that IRM can manage.

For extensive technical documentation on the .msg file format, see the MSDN article "Outlook Item (.msg) File Format."

Hide comments


  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.