IAF is a file format used for importing and exporting account information in Microsoft Outlook Express 6, Microsoft Windows Mail (Windows Vista), Microsoft Windows Live Mail and older versions of Microsoft Outlook. It can be decoded by code already available on the Internet. Here are a few links to the decoder code:
- https://code.google.com/p/iaf-decoder-coder/source/browse/trunk/File_Format_Iaf.php
- http://cpansearch.perl.org/src/PCZERKAS/
The above code works just fine however it has a problem – a good number of IAF fields are not recognized, especially for Windows Live Mail IAF file format. So here is my update on this topic and most up to date list of fields I could come up with. Also, this post contains a bit of documentation on IAF file format because I found that it is rather hard to find online and Microsoft never revealed IAF file format specification (to my knowledge – correct me if I am wrong).
Essentially, IAF comes in 2 flavors:
- WideChar version (16-bit characters – UTF-16LE format), used by Windows Mail and Windows Live Mail
- NarrowChar version (8-bit characters, encoded in specific charset encoding – usually the same like OS charset) used by Outlook Express 6 and older Microsoft Outlook
For NarrowChar version assignment of Field IDs is more or less known and available in the decoder code above. However, for the WideChar version, not all fields are recognized.
The above code contains a list of Field IDs with their names and assignment. The purpose of this post is to complement that list with some additional Field IDs and offer additional explanation of how the fields are organized – which can help in further reverse engineering of the IAF file format.
From what I could discover, it appears that the Field IDs are 9-digit numbers organized into sections which begin with certain 3-digit number which I will call “sections”. Between the Field IDs there are gaps, probably left intentionally for future upgrades to the file format without breaking the old format. The Field ID ranges are organized as following:
- 305-306 – General settings section
- 311-314 – IMAP settings section
- 321-323 – HTTP settings section
- 325-326 – NNTP settings section
- 331-332 – POP3 settings section
- 338-339 – SMTP settings section
The numbers above represent only the first 3 digits of a 9-digit Field ID, so for example, a full Field ID might be:
305464304 – belongs to “General settings” section and is Field ID for AccountName.
311952368 – belongs to “IMAP settings” section and is Field ID for IMAPServer.
The bold part of the Field ID number above represents the number from the above section range. This is similar for all other fields as defined in the list.
So, as promised above – here is full list of the Field IDs, including the ones missing from the above decoder code. You will notice that some fields are still unknown.
Unknown fields have an “UNKNOWN” in the comment and are prefixed by “GENERAL-“, “IMAP-“, “HTTP-“, and “NNTP-“. As it seems, there are no unknown fields in the POP3 and SMTP sections that I have discovered so far.
If you know what the UNKNOWN fields are used for or if you have additional ones to complement this list, please do leave a comment below this post to help in reverse engineering of the IAF file format so that a fully featured decoder can be written at last. I will of course update this post with the latest up-to-date table and share it with everyone.
The list is public domain and you are free to use in your code, for any purposes, commercial or any other (I would be happy if you notify me about it, but this is not needed).
You can also decode your own IAF files (for example, if you want to extract forgotten password) with the online decoder found here:
https://www.oeclassic.com/iaf-decoder
// Example IAF header // "\x66\x4D\x41\x49\x00\x00\x05\x00\x01\x00\x00\x00" // Offs 00-03 = 'fMAI' (IAF magic string) // Offs 04-05 = 0000 // Offs 06 = 05 or 07 (05=Outlook Express format/8-bit char, 07=Unicode Windows Mail/Windows Live Mail format/UTF-16LE char) // Offs 07 = 00 // Offs 08 = 00 or 01 or 02 (00=News acount, 01=IMAP/POP3 account, 02=Active Directory/LDAP account) // Offs 09-0a = 000000 // IAF fields - PHP code private $_fieldsTable = array( // 305-306 -> General settings 'AccountName' => array('305464304', 'nullstr_fmt', '', ''), 'TemporaryAccount' => array('305595369', 'ulong_le_fmt', 'bool_re', ''), 'GENERAL-305660911' => array('305660911', 'nullstr_fmt', '', ''), // UNKNOWN - added from Windows Mail and Windows Live Mail - NNTP only? 'ConnectionType' => array('305726441', 'ulong_le_fmt', 'iaf_ct_re', ''), 'ConnectionName' => array('305791984', 'nullstr_fmt', '', ''), 'ConnectionFlags' => array('305857513', 'ulong_le_fmt', 'num_re', ''), 'AccountID' => array('305988592', 'nullstr_fmt', '', ''), // Win32-Outlook-IAF fix 'BackupConnectionName' => array('306054128', 'nullstr_fmt', '', ''), 'MakeAvailableOffline' => array('306185193', 'ulong_le_fmt', 'bool_re', ''), 'ServerReadOnly' => array('306316277', 'ulong_le_fmt', 'bool_re', ''), 'GENERAL-306381801' => array('306381801', 'nullstr_fmt', '', ''), // UNKNOWN - added from Windows Mail and Windows Live Mail // 311-314 -> IMAP settings 'IMAPServer' => array('311952368', 'nullstr_fmt', '', ''), 'IMAPUserName' => array('312017904', 'nullstr_fmt', '', ''), 'IMAPPassword' => array('312083446', 'nullstr_fmt', '', 'iaf_password'), // NOTE - Windows Live Mail does not export passwords so this field can be absent 'IMAPAuthUseSPA' => array('312214517', 'ulong_le_fmt', 'bool_re', ''), 'IMAPPort' => array('312280041', 'ulong_le_fmt', 'num_re', ''), 'IMAPSecureConnection' => array('312345589', 'ulong_le_fmt', 'bool_re', 'iaf_bool'), 'IMAPTimeout' => array('312411113', 'ulong_le_fmt', 'num_re', ''), 'IMAPRootFolder' => array('312476656', 'nullstr_fmt', '', ''), 'IMAPUseLSUB' => array('312673269', 'ulong_le_fmt', 'bool_re', 'iaf_bool'), 'IMAPPolling' => array('312738805', 'ulong_le_fmt', 'bool_re', 'iaf_bool'), 'IMAPFullList' => array('312804341', 'ulong_le_fmt', 'bool_re', 'iaf_bool'), 'IMAPStoreSpecialFolders' => array('313000949', 'ulong_le_fmt', 'bool_re', 'iaf_bool'), 'IMAPSentItemsFolder' => array('313066480', 'nullstr_fmt', '', ''), 'IMAPDraftsFolder' => array('313197552', 'nullstr_fmt', '', ''), 'IMAPPasswordPrompt' => array('313525237', 'ulong_le_fmt', 'bool_re', 'iaf_bool'), 'IMAPDirty' => array('313590761', 'ulong_le_fmt', 'bool_re', 'iaf_bool'), 'IMAPPollAllFolders' => array('313656309', 'ulong_le_fmt', 'bool_re', 'iaf_bool'), 'IMAPDeletedItemsFolder' => array('313721840', 'nullstr_fmt', '', ''), // added from Vista 'IMAPJunkEmailFolder' => array('313787376', 'nullstr_fmt', '', ''), // added from Vista 'IMAPInboxFolder' => array('313852912', 'nullstr_fmt', '', ''), // added from Windows Mail and Windows Live Mail 'IMAP-313918453' => array('313918453', 'nullstr_fmt', '', ''), // UNKNOWN - added from Windows Mail and Windows Live Mail 'IMAP-313983989' => array('313983989', 'nullstr_fmt', '', ''), // UNKNOWN - added from Windows Mail and Windows Live Mail 'IMAP-314049525' => array('314049525', 'nullstr_fmt', '', ''), // UNKNOWN - added from Windows Mail and Windows Live Mail 'IMAP-314115061' => array('314115061', 'nullstr_fmt', '', ''), // UNKNOWN - added from Windows Mail and Windows Live Mail 'IMAP-314180597' => array('314180597', 'nullstr_fmt', '', ''), // UNKNOWN - added from Windows Mail and Windows Live Mail // 321-323 -> HTTP settings 'HTTPServer' => array('321782768', 'nullstr_fmt', '', ''), 'HTTPUserName' => array('321848304', 'nullstr_fmt', '', ''), 'HTTPPassword' => array('321913846', 'nullstr_fmt', '', 'iaf_password'), 'HTTPPasswordPrompt' => array('321979381', 'ulong_le_fmt', 'bool_re', 'iaf_bool'), 'HTTPAuthUseSPA' => array('322044905', 'ulong_le_fmt', 'bool_re', ''), 'HTTPFriendlyName' => array('322110448', 'nullstr_fmt', '', ''), 'HTTPDomainIsMSN' => array('322175989', 'ulong_le_fmt', 'bool_re', 'iaf_bool'), 'HTTPPolling' => array('322241525', 'ulong_le_fmt', 'bool_re', 'iaf_bool'), 'HTTPAdBarURL' => array('322307056', 'nullstr_fmt', '', ''), 'HTTPShowAdBar' => array('322372597', 'ulong_le_fmt', 'bool_re', 'iaf_bool'), 'HTTPMinPollingInterval' => array('322438135', 'ulong_le_fmt', 'num_re', ''), 'HTTPGotPollingInterval' => array('322503669', 'ulong_le_fmt', 'bool_re', 'iaf_bool'), 'HTTPLastPolledTime' => array('322569207', 'ulong_le_fmt', 'num_re', ''), 'HTTP-322634741' => array('322634741', 'nullstr_fmt', '', ''), // UNKNOWN - added from Windows Mail and Windows Live Mail 'HTTP-323552245' => array('323552245', 'nullstr_fmt', '', ''), // UNKNOWN - added from Vista 'HTTP-323683317' => array('323683317', 'nullstr_fmt', '', ''), // UNKNOWN - added from Windows Mail and Windows Live Mail 'HTTP-323748853' => array('323748853', 'nullstr_fmt', '', ''), // UNKNOWN - added from Windows Mail and Windows Live Mail // 325-326 -> NNTP settings 'NNTPServer' => array('325059568', 'nullstr_fmt', '', ''), 'NNTPUserName' => array('325125104', 'nullstr_fmt', '', ''), 'NNTPPassword' => array('325190646', 'nullstr_fmt', '', 'iaf_password'), // NOTE - Windows Live Mail does not export passwords so this field can be absent 'NNTPAuthMethod' => array('325321717', 'ulong_le_fmt', 'iaf_am_re', ''), 'NNTPPort' => array('325387241', 'ulong_le_fmt', 'num_re', ''), 'NNTPSecureConnection' => array('325452789', 'ulong_le_fmt', 'bool_re', 'iaf_bool'), 'NNTPTimeout' => array('325518313', 'ulong_le_fmt', 'num_re', ''), 'NNTPDisplayName' => array('325583856', 'nullstr_fmt', '', ''), 'NNTPOrganizationName' => array('325649392', 'nullstr_fmt', '', ''), 'NNTPEmailAddress' => array('325714928', 'nullstr_fmt', '', ''), 'NNTPReplyToEmailAddress' => array('325780464', 'nullstr_fmt', '', ''), 'NNTPSplitMessages' => array('325846005', 'ulong_le_fmt', 'bool_re', 'iaf_bool'), 'NNTPSplitMessageSize' => array('325911529', 'ulong_le_fmt', 'num_re', ''), 'NNTPUseGroupDescriptions' => array('325977077', 'ulong_le_fmt', 'bool_re', 'iaf_bool'), 'NNTPPolling' => array('326108149', 'ulong_le_fmt', 'bool_re', 'iaf_bool'), 'NNTPPostingFormat' => array('326173673', 'ulong_le_fmt', 'iaf_pf_re', ''), 'NNTPSignature' => array('326239216', 'nullstr_fmt', 'regkey_re', ''), 'NNTPPasswordPrompt' => array('326304757', 'ulong_le_fmt', 'bool_re', 'iaf_bool'), 'NNTP-326370281' => array('326370281', 'nullstr_fmt', '', ''), // UNKNOWN - added from Windows Mail and Windows Live Mail - NNTP only 'NNTP-326632425' => array('326632425', 'nullstr_fmt', '', ''), // UNKNOWN - added from Windows Mail and Windows Live Mail - NNTP only // 331-332 -> POP3 settings 'POP3Server' => array('331613168', 'nullstr_fmt', '', ''), 'POP3UserName' => array('331678704', 'nullstr_fmt', '', ''), 'POP3Password' => array('331744246', 'nullstr_fmt', '', 'iaf_password'), // NOTE - Windows Live Mail does not export passwords so this field can be absent 'POP3AuthUseSPA' => array('331875317', 'ulong_le_fmt', 'bool_re', ''), 'POP3Port' => array('331940841', 'ulong_le_fmt', 'num_re', ''), 'POP3SecureConnection' => array('332006389', 'ulong_le_fmt', 'bool_re', 'iaf_bool'), 'POP3Timeout' => array('332071913', 'ulong_le_fmt', 'num_re', ''), 'POP3LeaveMailOnServer' => array('332137461', 'ulong_le_fmt', 'bool_re', 'iaf_bool'), 'POP3RemoveWhenDeleted' => array('332202997', 'ulong_le_fmt', 'bool_re', 'iaf_bool'), 'POP3RemoveWhenExpired' => array('332268533', 'ulong_le_fmt', 'bool_re', 'iaf_bool'), 'POP3ExpireDays' => array('332334057', 'ulong_le_fmt', 'num_re', ''), 'POP3SkipAccount' => array('332399605', 'ulong_le_fmt', 'bool_re', 'iaf_bool'), 'POP3PasswordPrompt' => array('332530677', 'ulong_le_fmt', 'bool_re', 'iaf_bool'), // 338-339 -> SMTP settings 'SMTPServer' => array('338166768', 'nullstr_fmt', '', ''), 'SMTPUserName' => array('338232304', 'nullstr_fmt', '', ''), // NOTE - If SMTPAuthMethod is set to "Use incoming" (value=02) then username/password will be absent 'SMTPPassword' => array('338297846', 'nullstr_fmt', '', 'iaf_password'), // NOTE - Windows Live Mail does not export passwords so this field can be absent 'SMTPAuthMethod' => array('338428905', 'ulong_le_fmt', 'iaf_am_re', ''), 'SMTPPort' => array('338494441', 'ulong_le_fmt', 'num_re', ''), 'SMTPSecureConnection' => array('338559989', 'ulong_le_fmt', 'bool_re', 'iaf_bool'), 'SMTPTimeout' => array('338625513', 'ulong_le_fmt', 'num_re', ''), 'SMTPDisplayName' => array('338691056', 'nullstr_fmt', '', ''), 'SMTPOrganizationName' => array('338756592', 'nullstr_fmt', '', ''), 'SMTPEmailAddress' => array('338822128', 'nullstr_fmt', '', ''), 'SMTPReplyToEmailAddress' => array('338887664', 'nullstr_fmt', '', ''), 'SMTPSplitMessages' => array('338953205', 'ulong_le_fmt', 'bool_re', 'iaf_bool'), 'SMTPSplitMessageSize' => array('339018729', 'ulong_le_fmt', 'num_re', ''), 'SMTPSignature' => array('339149808', 'nullstr_fmt', 'regkey_re', ''), 'SMTPPasswordPrompt' => array('339215349', 'ulong_le_fmt', 'bool_re', 'iaf_bool') );