我正在尝试以编程方式从 Outlook（macOS 上的桌面客户端）安装中读取电子邮件。
对于 Thunderbird，我只需要读取存储在 /Users/xxxx/Library/Thunderbird/Profiles/xxxx.default-release/ImapMail/someemailaccount/ 中的文件。
该目录中的每个文件均以电子邮件帐户（收件箱、已发送等）上每个文件夹的名称命名，并且包含所有电子邮件（标头、正文和附件）。因此，我所要做的就是使用某种编程语言读取该文件，并根据 Content-Transfer-Encoding 标头应用正确的解码器。
对于 Outlook，我找到了此文件：/Users/xxxx/Library/Group Containers/UBF8T346G9.Office/Outlook/Outlook 15 Profiles/Main Profile/HxStore.hxd 但它看起来不可读，是二进制格式吗？它是压缩的还是加密的？
我尝试使用 Hex Field 应用程序查看其内容，它显示该文件包含一些数据块，但这些块看起来已损坏或加密/压缩（有关该文件的更多信息，请参见此处 https://boncaldoforensics.wordpress.com/2018/12/09/microsoft-hxstore-hxd-email-research/）：
<html><head>
<meta http-equiv="Content-Type" cp="text/;ñ; charset=utf-8"></Lð<body><div dir="ltr">1234567890ñ>
...
正如您在上面看到的，内容看起来在那里，但有上面有一些奇怪的字符。此外，该文件有很多没有字符或随机字符的部分。
有谁知道我怎样才能读取这个文件？
I'm trying to read emails from Outlook (desktop client on macOS) installation programmatically.
For Thunderbird I only need to read the files stored in /Users/xxxx/Library/Thunderbird/Profiles/xxxx.default-release/ImapMail/someemailaccount/.
Each file on that directory is named after the name of each folder on the email account (INBOX, Sent, etc.) and it contains all the emails (header, body and attachments). So all I have to do is to read that file with some programming language and apply the right decoder depending on the Content-Transfer-Encoding header.
For Outlook I found this file: /Users/xxxx/Library/Group Containers/UBF8T346G9.Office/Outlook/Outlook 15 Profiles/Main Profile/HxStore.hxd but it looks doesn't look to be readable, is it on a binary format? it is compressed or encrypted?
I tried to see its contents using Hex Field app and it displays that the file contains some blocks of data but those blocks look to be broken or encrypted/compressed (more info about that file here https://boncaldoforensics.wordpress.com/2018/12/09/microsoft-hxstore-hxd-email-research/):
<html><head>
<meta http-equiv="Content-Type" cp="text/;ñ; charset=utf-8"></Lð<body><div dir="ltr">1234567890ñ>
...
As you can see above, the contents look to be there but there are some strange characters on it. Also, the file has a lot of sections with no characters or random ones.
Does anybody know how can I read this file?
发布评论
评论（1）
如果您使用旧的 Outlook 界面（或切换回它），您可以非常轻松地访问底层 sqlite 数据库。
不过，这将在某个时候停止，Outlook 将完全切换到基于 Core Spotlight 的新界面。
我也在寻找一种从新界面访问电子邮件的方法，是的，数据似乎在这个文件中。还有人有关于如何访问的指示吗？
If you use the older outlook interface (or switch back to it) you can access the underlying sqlite database pretty easily.
However this will be discontinued at some point and Outlook will completely switch to the new interface based on Core Spotlight.
I am also looking for a way to access emails from the new interface, and yes the data seems to be in this file. Anybody else have pointers on how to access?