Forensic Email Inspection: Parsing Outlook .MSG (OLE2 MAPI) and .EML (RFC 5322) Files Without Outlook
Learn the architectural difference between Microsoft Outlook .MSG (OLE2 MAPI properties) and standard .EML (RFC 5322 MIME) email files, and how to inspect headers and attachments in your browser.
Quick Answer: To open Microsoft Outlook .msg files or standard .eml email messages on Windows, macOS, or Linux without installing Outlook or Thunderbird, drag your file into the ViewAnyFile MSG Viewer or EML Viewer. Our client-side parser renders the HTML/plain-text body, sender/recipient headers, and embedded file attachments 100% locally in your browser.
EML vs. MSG: Why Two Completely Different Email File Formats Exist
When archiving emails for legal discovery, compliance audits, customer support tickets, or cybersecurity incident response, you will encounter two fundamentally different file extensions—.eml and .msg:
| Technical Dimension | .EML (RFC 5322 / MIME) |
.MSG (Outlook MAPI Compound File) |
|---|---|---|
| Underlying Encoding | Plain-Text ASCII / UTF-8 Multipart Stream | Binary Microsoft OLE2 Compound Document (D0 CF 11 E0) |
| Governing Specification | IETF Open Standards (RFC 5322 & RFC 2045–2049) | Microsoft MS-OXMSG MAPI Property Specification |
| Attachment Storage | Base64-Encoded Text Blocks Inside MIME Boundaries | Binary OLE2 Sub-Storage Directories (__attach_version1.0_#...) |
| Native Software | Apple Mail, Thunderbird, Gmail ("Download message") | Microsoft Outlook Desktop (Windows Drag-to-Desktop) |
Inside an Outlook .MSG File: MAPI Property Tags & Compressed RTF
Whenever a Windows user drags an email out of Microsoft Outlook onto their desktop or into a shared folder, Outlook does not write a standard MIME text file—it serializes its internal Messaging Application Programming Interface (MAPI) object into an OLE2 Compound Document. If you inspect the internal directory tree of a .msg file, you will find dozens of streams named with cryptic hexadecimal codes like __substg1.0_0037001F:
- The first four hex digits specify the MAPI Property Identifier:
0037=PR_SUBJECT(Email Subject),0C1A=PR_SENDER_NAME,0E04=PR_DISPLAY_TO,1000=PR_BODY(Plain Text),1013=PR_HTML(Raw HTML), and1009=PR_RTF_COMPRESSED(LZFu-compressed Rich Text Format). - The last four hex digits specify the MAPI Data Type:
001Fdenotes a UTF-16LE Unicode string (PT_UNICODE),001Edenotes an 8-bit ANSI string (PT_STRING8), and0102denotes a raw binary byte array (PT_BINARY). - Each attachment lives inside an isolated sub-storage directory (e.g.,
__attach_version1.0_#00000000) containing3707(PR_ATTACH_LONG_FILENAME) and37010102(PR_ATTACH_DATA_BIN—the exact binary bytes of the attached PDF, XLSX, or image).
Inside an .EML File: Multipart MIME Boundaries & Forensic Headers
By contrast, an .eml file is the literal wire protocol of internet email. It begins with chronological Received: hops (read bottom-to-top to trace the originating IP address), cryptographic authentication results (DKIM-Signature:, Received-SPF:, and Authentication-Results:), and a Content-Type: multipart/mixed; boundary="..." declaration. Below the blank line (CRLF CRLF) separating headers from the body, MIME boundary strings divide the message into Quoted-Printable text/HTML parts and Base64-encoded attachments.
Inspecting & Extracting Email Attachments Safely in the Browser
Opening suspicious or unfamiliar .msg and .eml attachments inside a desktop email client connected to your corporate Exchange account can trigger automatic remote tracking pixels or macro execution. When you drop an .eml or .msg file into ViewAnyFile.app, our parser decodes the MAPI or MIME structure inside a sandboxed browser tab, displays the sender/recipient metadata and body cleanly, and lists every embedded attachment so you can download or inspect attached PDFs, spreadsheets, and images one by one.