I'm trying to calculate the stream name for the named property part of an MSG file, specifically string named properties. The MSG file format specification says that the ID is generated as follows:
Stream ID = 0x100m ((ID XOR (GUID index << 1 | 1)) MOD 0x1f
Where the ID value is the CRC-32 for the "Unicode name identifier". I'm also confident that 0x100m
is actually 0x1000
.
This somehow maps 'x-mailer'
to 0x100f
when the GUID index is 3. The value for ID is 0x894e50ff (since it is stored in another location), but how does 'x-mailer'
get converted to that value?
(These are the properties stored under "__nameid_version1.0"
, partly inside the "__substg1.0_00040102"
stream).