What Is a DAT File? Winmail.dat, and How to Open and Check One
A DAT file is a generic data file, and winmail.dat is the kind most people meet. Three extractors disagreed on 15 of the 21 damaged copies we made of one. Jump to your question below, or work through it in order.
What Is a DAT File? A generic ending, and the winmail.dat kind we tested
Short answer
A DAT file is a generic data file, and the kind most people meet is winmail.dat, an Outlook attachment that stores a message in TNEF. FileInfo lists 17 DAT types, and file-extensions.org lists 15 records. A winmail.dat file starts with the bytes 78 9f 3e 22.
We read 24 winmail.dat files from the Apache POI and tnefparse test data and damaged one of them in 21 ways. The file command named all 24 as TNEF, and 7-Zip refused all 24. Three extractors disagreed on 15 damaged copies, and 13 kinds of damage came back byte for byte.
To open one, read the open steps. To check one, read the check steps. If your DAT file will not open, begin with the eight causes.
A DAT file has a generic ending, so the ending does not name a program. The kind most people meet is winmail.dat, which Outlook attaches to a message sent in Rich Text format, per Microsoft.
Picture an email from a colleague with one attachment called winmail.dat and no readable file in it. Picture a second file, unins000.dat, in a program folder. Both end in .dat. They share no maker and no program.
FileInfo lists 17 DAT file types. They include a generic data file, a Minecraft file, a Windows registry hive and a Guild Wars 2 archive. The Exchange E-mail Attachment is winmail.dat from Microsoft.
File-extensions.org lists 15 DAT records. They include program data, a Bitcoin wallet, a thumbnail cache and a Video CD movie, and four are marked obsolete. None of the 15 is winmail.dat.
We tested the winmail.dat kind, because Microsoft publishes its layout and open projects ship sample files. The Apache POI project on GitHub ships 6 TNEF test files, and the tnefparse project ships 19 more. We read all 25.
Where our DAT files come from
Apache POI is a Java project, and HMEF is its component for TNEF. Apache describes HMEF as a pure Java library that reads winmail.dat files and gives read only access to the body, the subject, the attachments and the attributes.
One of the 25 DAT files is a fuzz test file, oom.tnef, which is 53 bytes long and made to break readers. We call the other 24 regular DAT files. They are 2,272 to 1,543,512 bytes long and 4,246,497 bytes in total, and the median is 23,376.5 bytes.
We damaged one regular file in 21 ways, and every copy changes one thing. We worked on Linux and had no copy of Outlook, so we opened no file in Outlook.
DAT file facts at a glance
| Property | Value |
|---|---|
| Meaning | The ending is generic. FileInfo lists 17 types and file-extensions.org lists 15 records. This page tests the winmail.dat kind. |
| Ending | .dat. Many programs use it, and the ending names none of them. |
| First bytes |
Winmail.dat files start with 78 9f 3e 22, the TNEF signature. All 24 of our regular DAT files do.
|
| Layout | A 4 byte signature, a 2 byte key and a series of attributes. Every attribute has a level, an id, a length, data and a 2 byte checksum. |
| Attachments | 18 of our 24 regular DAT files have attachments, 40 in all. The most in one file is 5. |
| Sizes | Our 24 regular DAT files are 2,272 to 1,543,512 bytes long, and the median is 23,376.5 bytes. |
| Opens with | FileInfo names File Viewer Plus, Outlook 365, Encryptomatic Message Viewer Lite, Traction WinMail Decoder Pro and Winmail.dat Reader. We tested tnef, tnefparse and ytnef on Linux. |
| Our tests | 24 regular DAT files, 21 damaged copies and 13 repairs checked on 18 DAT files. |
Wrong page? An MSG file stores one Outlook item and starts with different bytes. See how the neighbors differ.
Which Kind of DAT File Do You Have? Four questions, and the first bytes answer the first one
Four questions name the kind of a DAT file. Start with the first bytes. Every winmail.dat file we read starts with 78 9f 3e 22, and the ending names none of the kinds.
Work down the figure and stop at the first yes. We tested the first row with files. The other rows rest on the pages named in them, because we found no sample file for those kinds.
The four kinds in detail
| Kind | Clue and source |
|---|---|
| Winmail.dat (TNEF) |
The first 4 bytes are 78 9f 3e 22. IANA lists a 1996 email that says the type needs the file name winmail.dat. Tested on 24 regular DAT files.
|
| Text based DAT file | The bytes are readable text. FileInfo says text based DAT files open in any text editor, and lists an XML file for Wii game dumps as one. Source only. |
| Game or program data | FileInfo names Minecraft, Geometry Dash, SimCity 4 and Guild Wars 2 DAT files, and registry hives like NTUSER.DAT. It says most are not meant to be opened by hand. Source only. |
| Packed archive | FileInfo says Prison Architect archives are ZIP compressed and open in 7-Zip after a rename to .zip, and that Minecraft data files are Gzip compressed. Source only. |
Start with the first bytes
Open the DAT file in a hex viewer or use xxd -l 16. If the first 4 bytes read 78 9f 3e 22, the DAT file is TNEF. Any other start means another kind, and the program that made the DAT file is the best clue.
The file command goes further. It printed application/ for all 24 of our regular DAT files. It gave the same answer for the 19 DAT files that end in .tnef, so it reads the bytes and not the ending.
78 9f 3e 22, name a TNEF file.
Not sure your DAT file is a winmail.dat file at all? Check it with our script.
What Is Inside a Winmail.dat File? A signature, a key and a series of attributes
Winmail.dat files are TNEF streams made of a 4 byte signature, a 2 byte key and a series of attributes. Our example is 3,481 bytes long and has 22 attributes and 2 attachments.
We read these files because Microsoft publishes the rules and open projects ship examples, so every value can be checked. Two short commands show the first 16 bytes and name the type. We copied the example to a short name, example.dat.
xxd -l 16 example.dat
00000000: 789f 3e22 3702 0106 9008 0004 0000 0000 x.>"7...........
file -b example.dat | cut -d, -f1-3
Transport Neutral Encapsulation Format (TNEF), OEM codepage 1252 (checksum 0xe8), MessageAttribute "IPM.Microsoft Mail.Note"
file -b --mime-type example.dat
application/vnd.ms-tnef
Bytes 0 to 3, 78 9f 3e 22, are the signature. Read with the low byte first, they give 0x223E9F78, the value that the tnefparse source names TNEF_SIGNATURE. Bytes 4 and 5, 37 02, are the key, 0x0237 or 567.
Microsoft calls the key a 16 bit number that must not be zero and that sets the start of the reference numbers for attachments. Our 24 regular DAT files use 22 different keys, from 8 to 60,004, and none is zero.
The file command prints a longer line. It adds the codepage, a checksum value and the message class stored in the DAT file. We cut it to three fields, and the last line prints application/.
IANA publishes a page for that type. It is an email from Microsoft dated March 25, 1996, that asks for an update on the type and says it needs the file name winmail.dat. We could not read the full registry table, so we state no status.
The attributes, byte by byte
After the key, the file is a series of attributes. Microsoft says an identifier is a 32 bit number made of two 16 bit words. The high word names the data type and the low word names the attribute. Lengths are 32 bit numbers.
Our example starts its first attribute at byte 6 with 01, the level byte. Bytes 7 to 10, 06 90 08 00, are the identifier 0x00089006, the TNEF version. Bytes 11 to 14 give the length, 4. The data is 00 00 01 00, and a 2 byte checksum follows.
The checksum is the sum of the data bytes, modulo 65536. Microsoft gives that rule, and in every attribute we checked it covers the data and nothing else. For the version attribute the sum is 1, so the checksum is 01 00.
The level byte is 1 for a message attribute and 2 for an attachment attribute. Message attributes come first. the Microsoft stream page says every attachment then starts with the attribute attAttachRenddata, 0x00069002, and all 18 of our files with attachments do.
What the attributes store
| Attribute | What it stores and what we saw |
|---|---|
| TNEF version | Attribute 0x00089006, 4 bytes. It is the first attribute in all 24 regular DAT files, and the value is 0x00010000 in every one. |
| OEM codepage | Attribute 0x00069007, in all 24. The value is 1252 in 23 DAT files and 1251 in one. |
| Message class | Attribute 0x00078008, in 17 DAT files. 14 are IPM.Microsoft Mail.Note, and the others are a read receipt, a voicemail and an appointment. |
| MAPI properties | Attribute 0x00069003, in all 24. the Microsoft TNEF page says TNEF has a general attribute for any message property that lacks one of its own. |
| Attachment start | Attribute 0x00069002 opens every attachment. 18 DAT files have attachments, 40 in all, and the most in one file is 5. |
| Attachment name and data | Attributes 0x00018010 and 0x0006800f store the title and the bytes. 16 DAT files have a title attribute and 15 have a data attribute. |
| Recipients | Attribute 0x00069004, in 3 DAT files. |
What the sources say
Microsoft publishes the TNEF rules as MS-OXTNEF, and the page shows protocol revision 15.0 dated 5/20/2025. It says the document specifies how to encode and decode Message and Attachment objects as a stream.
A second page, TNEF stream structure on Microsoft Learn, gives the key and the attribute rules. It does not list the fields of an attribute in order, so we took the field order from our own files and from the tnefparse source.
The map is small. Our script reads the signature, the key and every attribute. It does not read the MAPI properties inside, so damage in a property can pass it, as the 21 copies show.
What Did We Find in 24 Winmail.dat Files? Six readers, and they did not agree
We read 24 winmail.dat files with six readers. The file command named all 24, 7-Zip refused all 24, tnefparse and ytnef read all 24 and tnef read 21. Our 18 line script passed 18 DAT files, with 3 warnings and 3 flags.
All 24 DAT files come from the Apache POI and tnefparse test data, so this is a study of two projects and not a survey of every winmail.dat file. We left out one fuzz test file, which we cover below, and we opened no file in Outlook.
Readers were file 5.45, 7-Zip 23.01, tnefparse 1.4.0, tnef 1.4.18, ytnef 2.1.2 and our own script on Python 3.13, all on Linux. A reader passed a file when it returned data without an error.
| Test | Result |
|---|---|
| The file command |
Printed application/ for all 24, including the 19 DAT files that end in .tnef.
|
| 7-Zip | Refused all 24 regular DAT files. |
| tnefparse | Read all 24 and returned 40 attachments. It checks no checksums unless you ask, so it read the 3 DAT files that tnef refused. |
| tnef | Read 21 and returned 35 attachments. It refused 3 DAT files. Two have a wrong checksum, and one ends 2 bytes early. |
| ytnef | Read all 24 and returned 30 attachments. It found fewer attachments than tnefparse in 5 DAT files and more in one. |
| Our script | Printed OK for 18 DAT files, WARN for 3 and FLAG for 3. The warnings are tails of 1 or 2 bytes after the last attribute. The flags are the 3 DAT files that tnef refused. |
| Sizes | 2,272 to 1,543,512 bytes, with a median of 23,376.5 and a total of 4,246,497. |
| Attachments | 40 attachments in 18 DAT files. The most in one file is 5, and 6 DAT files have none. |
One layout and 24 DAT files
Every regular DAT file starts with the signature 78 9f 3e 22. Every one has the TNEF version as its first attribute, with the value 0x00010000, an OEM codepage attribute and a MAPI properties attribute. The codepage is 1252 in 23 DAT files and 1251 in one.
17 DAT files store a message class. 14 are IPM.Microsoft Mail.Note, and the other three are a read receipt, a voicemail and an appointment. 3 DAT files store a recipient table, and 6 DAT files have no attachment.
Where the extractors split
The three extractors returned the same list of names and file hashes on 16 of the 24 regular DAT files. They split on the other 8. tnef refused 3 DAT files, and on the remaining 5 at least one extractor returned a different list.
Two splits concern content. On tp_MAPI_OBJECT and tp_MAPI_ATTACH_DATA_OBJ, tnefparse and tnef returned the same names with different bytes for an attachment. We did not find out which bytes are right.
ytnef returned nothing for 5 DAT files where tnefparse found attachments. It found one calendar file in tp_triples, where tnefparse and tnef found none.
The readers also write names in different ways. For tp_umlaut, tnefparse decoded a name with umlauts, while tnef and ytnef wrote the raw 8 bit bytes. ytnef also replaced the spaces in a picture name with underscores. The file bytes matched.
The fuzz test file
The fuzz test file, oom.tnef, has 53 bytes and the right signature. The file command named it TNEF. 7-Zip and tnef refused it, and ytnef printed a checksum error and wrote nothing. Our script flagged a wrong checksum at byte 6.
tnefparse stopped with a MemoryError when we capped its memory at 2 GiB. A reader that uses up its memory on 53 bytes gives reason to cap the memory of any reader you point at files from strangers.
Names, dates and attachments
Attachments matter for safety. Of the 40 attachments that tnefparse returned, 5 have no extension, 5 are .doc files, 5 are .pdf files and 5 are .png files. One is AUTOEXEC.BAT and none is .exe. We opened none of them.
Read the study with care. It shows what six readers do with 24 winmail.dat files from two projects. Files from other mail programs and versions can differ, and we had no copy of Outlook to save our own.
What Happens When a DAT File Is Damaged? 21 broken copies, and the extractors disagreed on 15
We damaged one winmail.dat file in 21 ways. The three extractors disagreed on 15 copies, and none of them matched the original on 11. Our script flagged or warned on 19, and 13 kinds of damage came back byte for byte.
The 21 copies come in three groups of 7. Group A changes the signature, the key or the first attribute. Group B changes the length of the DAT file or how it was moved. Group C changes the middle of the DAT file. Every copy changes one thing in example.dat, which is 3,481 bytes long.
We asked three questions about every copy. What did every reader return, compared with its answer on the original? Did our script flag it? Did one command restore the original, checked by SHA-256 on the 18 regular DAT files that our script passes?
Copies that split the extractors
A2 sets the key to zero, and A4 changes the identifier of the first attribute. All three extractors returned the original data for both. Microsoft says the key must not be zero, so a rule on paper did not stop them.
C3 flips one bit in the checksum of a middle attribute. tnefparse returned the original attachments, tnef refused the DAT file and ytnef returned different data. Three extractors gave three answers.
B2 cuts the DAT file to half. All three returned different data and none refused. B3 keeps only the signature and the key, and all three returned an empty list without an error.
So no extractor works as judge of the others. A refusal warns you that something is wrong. A reader that returns different data says nothing, and tnefparse or ytnef did that on 14 of the 21 copies.
tnef is the strictest. It refused 15 of the 21 copies, matched the original on 3 and returned different data on 3. ytnef never refused a copy. It matched the original on 7 and returned different data on 14.
The 19 copies our script flagged or warned on
A1 and A7 change the signature, and B6 removes the first byte, so none starts with 78 9f 3e 22. The script says so for all three DAT files. A3 sets the first level to 3, and the script prints level 3 at byte 6. A2 sets the key to zero, and B3 keeps only 6 bytes.
A5 and A6 break the first checksum. B5 changes every newline into a pair of bytes, which moves everything after it. C1, C2, C3 and C6 break a checksum further in. For all of these the script reports a wrong checksum and the byte where it starts.
B1 and B7 cut the last attribute, and the script says it goes past the end. B4 adds 512 zero bytes, and the script reports level 0 at byte 3481. C7 zeroes half of the DAT file and gets the same message.
A4 and B2 only get a warning. A4 starts with an attribute that is not the version. B2 leaves 2 bytes after the last complete attribute. That warning is weak, because 3 healthy regular DAT files end in tails of 1 or 2 bytes too.
The 2 copies our script passed
C4 changes the first byte of an attachment title and fixes the checksum. C5 changes one byte of attachment data and fixes the checksum. Both keep every checksum right, so the script passes them.
All three extractors returned the original list for C4, because the changed title did not reach their output. All three returned different data for C5, and none of them gave a warning.
A pass means the checksums fit the data and not that the data is the original. Only the sender, a hash or a second copy shows a change that keeps the checksums right.
Repairs that worked
We wrote one command per kind of damage, 13 in all, and tested it on the 18 regular DAT files that our script passes. A hash matched the original for every kind on all 18 DAT files.
A1 and A7 write the signature back. A3 and A4 write the first level and the version identifier back. B6 puts the first byte back, B5 changes every 0d 0a back into 0a and B4 removes the zero bytes.
A5, A6, C2 and C3 find the true length or checksum of one attribute. B1 and B7 cut off only the last checksum, so the repair writes it again. These fixes work because the data stayed intact.
Our first version of the length repair failed on all 18 DAT files for A5 and on one for C2. A length that is off by one can still end next to a valid level byte by chance. The final version first tests whether a checksum fits one byte before or after the stored length.
A6, C3 and the checksum repairs assume the checksum is wrong and the data is right. If a bit in the data flipped instead, as in C1, the repair would write a checksum that fits wrong data. Use them only when a second source shows the data is right.
What no command repaired
A2 needs no repair, because all three extractors read it. B2 and B3 cut the DAT file, C1 flips a bit, C6 zeroes 512 bytes and C7 zeroes half of the DAT file. Cut and zeroed data is gone, and no header brings it back.
C4 and C5 change data and keep the checksums right, so no rule shows what the original was. We tested no repair for those 8 copies.
Read the grid with care. Every copy changes one thing in one DAT file. Damage in the wild changes many things at once. We opened no copy in Outlook, and our repairs rely on rules that fit these 18 regular DAT files.
What Does Our Expert Say About DAT Files? A note from Neeraj Singh on trusting one reader
Compare two readers before you trust one. Our three extractors disagreed on 15 of 21 damaged copies, so one reader that opens a DAT file proves little.
Expert insight
“A winmail.dat file is a list of attributes with a checksum on every one, and our extractors gave different answers on the same damaged copy. In our test only 3 of 21 copies read the same in every tool. Compare two readers, keep the original and write down its hash before you repair anything.”
Why one reader is not enough
Extractors can return different data without an error. tnefparse or ytnef did that on 14 of our 21 copies, and neither printed a warning. A refusal at least warns you that something is wrong.
We had no copy of Outlook. If Outlook shows the attachments of your message, treat that as the best test. Use the readers on this page when it does not. tnef refused 15 of 21 copies, so it makes a stricter second reader than ytnef.
Copy your DAT file before you repair it. Work on the copy and keep the original untouched. Write down its SHA-256 hash first, so you can show later that the copy came back as it was.
How Do You Open a DAT File? Free decoders, Linux tools and how to stop the attachment
FileInfo names five Windows programs and one Android program for winmail.dat files. We opened none in any mail program. On Linux, tnefparse and ytnef read all 24 of our regular DAT files, and tnef read 21.
The table lists what the sources name and what we tested. Rows with version numbers are tools we tested. Every other row rests on the page named in it, and we tested none of those.
| Program | What it does |
|---|---|
| Outlook 365 | FileInfo lists Microsoft Outlook 365 for Windows as a free program for winmail.dat files. We did not test it. |
| File Viewer Plus | FileInfo lists File Viewer Plus for Windows and File Viewer for Android. We tested neither. |
| Message Viewer Lite | FileInfo lists Encryptomatic Message Viewer Lite for Windows as a free trial. We did not test it. |
| WinMail decoders | FileInfo lists Traction WinMail Decoder Pro as free trials and Winmail.dat Reader as free software, both for Windows. We tested neither. |
| tnef | Version 1.4.18. A command line tool. It read 21 of 24 regular DAT files and wrote 35 attachments. |
| tnefparse | Version 1.4.0. A Python library. It read all 24 regular DAT files and returned 40 attachments. |
| ytnef | Version 2.1.2. A command line tool. It read all 24 regular DAT files and wrote 30 attachments. |
| Apache POI HMEF | Apache describes a Java library that reads winmail.dat files. We did not test it. |
| The file command | Version 5.45. It named all 24 regular DAT files as TNEF. |
| 7-Zip | Version 23.01. It refused all 24 regular DAT files. |
Open a DAT file on Linux
file -b example.dat | cut -d, -f1-3
Transport Neutral Encapsulation Format (TNEF), OEM codepage 1252 (checksum 0xe8), MessageAttribute "IPM.Microsoft Mail.Note"
tnef -C out -f example.dat
ls out
AUTHORS
README
python3 -c "from tnefparse import TNEF; print([(a.name, len(a.data)) for a in TNEF(open('example.dat', 'rb').read()).attachments])"
[('AUTHORS', 244), ('README', 893)]The file command names the type, and tnef writes the attachments into the folder you give it. The tnefparse library lists names and sizes, which shows that a reader understands the attachment records and not only the signature.
Install the three tools
On Debian and Ubuntu the packages are tnef and ytnef-tools, and tnefparse installs with pip install tnefparse. The project pages for tnef, ytnef and tnefparse show their licenses, which are GPL 2.0 for the first two and LGPL 3.0 for the last.
Stop getting winmail.dat files
Microsoft explains that Outlook sends a message in TNEF when its format is Rich Text. HTML and Plain Text messages do not use TNEF. A mail program that cannot read TNEF shows the data as an unreadable attachment.
The fix lies with the sender. Microsoft names three ways. The sender can change the default format in the Outlook mail options, set the DisableTNEF value or change the format of one message. Ask the sender to switch to HTML or Plain Text.
What to use for every kind
Winmail.dat from Outlook. Use a decoder from the table, or tnef on Linux. Ask the sender to switch the message format, so the next mail arrives with normal attachments.
Text based DAT files. Open them in any text editor, per FileInfo. Game and program data. Use the program that made the DAT file. FileInfo says most are not meant to be opened by hand.
Install programs from their makers. Take Outlook from Microsoft and other programs from their own pages. A free site that offers to decode any winmail.dat file receives your attachments, so try the steps on this page first.
How Do You Check a DAT File? Six steps and a script of 18 lines
Check a DAT file in six steps. Read the first 16 bytes, name the type, use a script and compare two readers. Our 18 line script passed 18 of 24 regular DAT files and flagged or warned on 19 of 21 damaged copies.
First reads need no Python. The xxd command prints bytes, and wc prints the length. In a healthy file the first 4 bytes are the signature, and the next 2 are the key.
xxd -l 16 example.dat
00000000: 789f 3e22 3702 0106 9008 0004 0000 0000 x.>"7...........
wc -c < example.dat
3481Read the first line from the left. Bytes 0 to 3 are the signature, bytes 4 and 5 are the key and byte 6 is the level of the first attribute. The length, 3,481 bytes, is the signature, the key and 22 attributes with nothing left over.
Check DAT files with Python
The script reads the signature and the key of a DAT file. It then walks the attributes, one after another. For every attribute it reads the level, the identifier and the length, and it adds up the data bytes to test the checksum.
It warns if bytes remain that do not fill an attribute, and if the first attribute is not the version. It prints OK, WARN or FLAG. It never changes a file.
import struct, sys
def peek(b):
if b[:4] != bytes.fromhex('789f3e22'): return 'FLAG', 'start is not 78 9f 3e 22'
if len(b) < 6 or b[4:6] == b'\0\0': return 'FLAG', 'key is missing or zero'
p, n, first = 6, 0, None
while p < len(b):
if p + 9 > len(b): return ('WARN', '%d bytes after the last attribute' % (len(b) - p)) if n else ('FLAG', 'cut inside the first attribute')
lvl, aid, ln = b[p], struct.unpack('<I', b[p+1:p+5])[0], struct.unpack('<I', b[p+5:p+9])[0]
if lvl not in (1, 2): return 'FLAG', 'level %d at %d' % (lvl, p)
if p + 9 + ln + 2 > len(b): return 'FLAG', 'attribute at %d goes past the end' % p
if sum(b[p+9:p+9+ln]) & 0xFFFF != struct.unpack('<H', b[p+9+ln:p+11+ln])[0]: return 'FLAG', 'checksum wrong at %d' % p
first = first or (lvl, aid); n += 1; p += 11 + ln
if not n: return 'FLAG', 'no attributes after the key'
if first != (1, 0x89006): return 'WARN', 'first attribute is not the version'
return 'OK', '%d attributes' % n
if __name__ == '__main__':
for f in sys.argv[1:]:
s, m = peek(open(f, 'rb').read()); print(s, m, f)Here is what it printed for four healthy DAT files. They are a small one, our example, one with umlauts in a name and a large file of 515,876 bytes.
python3 dat_peek.py one.dat example.dat umlaut.dat big.dat
OK 16 attributes one.dat
OK 22 attributes example.dat
OK 22 attributes umlaut.dat
OK 23 attributes big.datEvery answer starts with OK, WARN or FLAG. A healthy answer then gives the number of attributes and the file name.
python3 dat_peek.py A1_signature_changed.dat A3_first_level_3.dat B1_last_byte_cut.dat B5_crlf_text_mode.dat C2_mid_length_plus1.dat C4_name_changed_checksum_fixed.dat
FLAG start is not 78 9f 3e 22 A1_signature_changed.dat
FLAG level 3 at 6 A3_first_level_3.dat
FLAG attribute at 3270 goes past the end B1_last_byte_cut.dat
FLAG checksum wrong at 154 B5_crlf_text_mode.dat
FLAG checksum wrong at 1738 C2_mid_length_plus1.dat
OK 22 attributes C4_name_changed_checksum_fixed.datA1 does not start with the signature. A3 stores level 3, and B1 cuts the last attribute. B5 changes every newline into a pair of bytes, so a checksum fails at byte 154. C2 stores a wrong length, so a checksum fails at byte 1738. C4 passes, because its checksums fit the changed name.
What the script found in our DAT files
| Result | Cases |
|---|---|
| Passed (18 regular DAT files) | The signature and the key are right, every checksum fits the data and the first attribute is the version. |
| Warned (3 regular DAT files, A4, B2) | Three healthy files end in tails of 1 or 2 bytes. B2 gets the same warning, and A4 gets one because the first attribute is not the version. |
| Flagged but readable (3 regular DAT files) |
tp_IPM-DistList and tp_duplicate_filename have wrong checksums, and tp_bad_checksum ends 2 bytes early. tnefparse and ytnef read all three, and tnef refused all three.
|
| Start is not the signature (A1, A7, B6) | A changed byte, a reversed signature or a lost first byte. All three flagged. |
| Key and first attribute (A2, A3, A5, A6, B3) | A2 prints a zero key. A3 prints level 3 at byte 6. A5 and A6 print wrong checksums at byte 6. B3 prints no attributes after the key. |
| Cuts and added bytes (B1, B4, B7, C7) | B1 and B7 print an attribute that goes past the end. B4 and C7 print level 0 at the first byte that is not an attribute. |
| Checksums further in (B5, C1, C2, C3, C6) | All five print wrong checksums at the byte where the first damaged attribute starts. |
| Passed (C4, C5) | The checksums fit the data, so the script passes them. C4 reads as the original in all three extractors, and C5 differs in all three. |
The script has limits. It does not read the MAPI properties, so it passes C4 and C5. It flags 3 healthy DAT files that tnefparse and ytnef read, so flags are reasons to look closer and not a verdict. It repairs nothing. The repair commands fix the 13 kinds of damage we tested.
Check order for any DAT file
- Copy your DAT file, write its SHA256 hash and work on the copy.
-
Read the first 16 bytes. The signature
78 9f 3e 22means TNEF, and any other start means another kind. See the list of kinds. -
Name the type with the file command.
application/is the answer you want. Another answer means another kind or a damaged start.vnd .ms-tnef - Use our script. The first word is OK, WARN or FLAG, and a flag names the byte where the DAT file stops making sense.
- Extract with two programs, like tnef and tnefparse, and compare the names and the DAT file hashes. One reader can return wrong data without an error.
- Ask the sender for the DAT file again or for its hash. We opened none in any mail program, so passes show sound checksums and not a message that displays.
Is a DAT File Safe to Open? Reading is safe, and attachments need care
Reading the bytes of a DAT file starts nothing, so it is safe. The risk lies in the attachments inside a winmail.dat file, because they can be any type. Open them only from a sender you trust.
We started nothing. Our readers only read bytes and wrote attachments into empty folders, and the files are public test data from the Apache POI and tnefparse projects. We scanned none for malware, and the 40 attachments include no .exe file.
The TNEF effects page from Microsoft says a mail program that cannot read TNEF shows the data as an unreadable attachment. The names inside are the first clue. Extract into an empty folder, read the list and open only what you expected.
Names and addresses inside
TNEF packs the MAPI properties of a message. Microsoft names the sender name as one example. So a winmail.dat file can store names and addresses, and you should check before you share one.
Files with a DAT name
A file named winmail.dat can be anything. The file command named our 19 DAT files that end in .tnef the same way as the 5 that end in .dat. Read the first 4 bytes before you trust either ending.
Attachments from a stranger
Extract into an empty folder with a tool you installed from its maker. List the names and types, and delete the folder if one looks wrong. Check the sender before you open a document.
Not sure? Check it first. Copy the hash, read the first bytes with our check steps and ask the sender where the DAT file came from. Open it last.
Why Will Your DAT File Not Open? Eight causes, and what to do about every one
Most DAT files that will not open fail for one of eight reasons. Read the first bytes, name the type and use the script. Our script flagged or warned on 19 of 21 damaged copies, and 13 kinds of damage came back byte for byte.
We damaged one DAT file in 21 ways and tested repairs on every healthy DAT file where the damage changes bytes. The table groups what we saw into eight causes.
Every row says what happens to your DAT file and what to try. Fixes work on copies, and none changes the original. We opened no repaired file in any mail program, so repaired files show only that its checksums fit.
| Cause | Result and fix |
|---|---|
| The wrong kind of file (1) |
The file does not start with 78 9f 3e 22. Our script flagged the start of 3 damaged copies. Fix: Find the kind in the kind chart and open the DAT file with the program for that kind.
|
| A signature that is changed or lost (2) |
A1 changes the first byte, A7 reverses the signature and B6 loses the first byte. Our script flagged all three DAT files. Fix: Write 78 9f 3e 22 over bytes 0 to 3, or put the lost byte 78 back in front. Both came back byte for byte on all 18 DAT files.
|
| A level or an identifier that is wrong (3) |
A3 sets the first level to 3, and A4 changes the identifier of the first attribute. Fix: Write 01 at byte 6 and 06 90 08 00 at bytes 7 to 10. Both came back byte for byte.
|
| A length or a checksum that is wrong (4) | A5 adds one to the first length, A6 breaks the first checksum, C2 adds one to a length further in and C3 breaks a checksum there. Fix: Find the length at which the sum of the data bytes equals the stored checksum, or write the checksum that fits the data. All four came back byte for byte. Use the checksum fix only when you know the data is right. |
| A copy made in text mode (5) | B5 replaces every newline byte 0a with 0d 0a, so the DAT file grows and the checksums fail. Fix: Replace every 0d 0a with 0a. It worked on all 18 DAT files. Use binary mode for transfers from now on. |
| A tail of extra bytes (6) | B4 adds 512 zero bytes. Our script flagged level 0 at the first of them, and tnef refused the copy. Three healthy files end in tails of 1 or 2 bytes, and all three extractors read those. Fix: Cut the bytes after the last complete attribute. It worked on all 18 DAT files. |
| A file that is cut (7) | B1 and B7 cut the last 1 or 2 bytes, and the script says the last attribute goes past the end. B2 cuts the DAT file to half and B3 keeps 6 bytes. Fix: For B1 and B7, where only the last checksum is missing, write it again. It worked on all 18 DAT files. For B2 and B3, ask for a new copy. |
| Data that is zeroed, flipped or changed (8) | C1 flips one bit, C6 zeroes 512 bytes and C7 zeroes half of the DAT file. C4 and C5 change data and fix the checksum. Fix: Ask for fresh copies or backups. We tested no repair, and the script passes C4 and C5. |
Repairs we tested
One short script covers all 13 fixes. It takes the damaged file, one kind code and a name for the new file. The commands after it are the ones we used, with short file names.
import struct, sys
SIG = bytes.fromhex('789f3e22')
def csum(b, p, n): return sum(b[p+9:p+9+n]) & 0xFFFF
def ends_ok(b, q): return q == len(b) or (q < len(b) and b[q] in (1, 2))
def ok_at(b, p, n):
q = p + 9 + n
return q + 2 <= len(b) and csum(b, p, n) == b[q] | b[q+1] << 8 and ends_ok(b, q + 2)
def fix(b, how):
b = bytearray(b)
if how in ('A1', 'A7'): b[:4] = SIG
elif how == 'A3': b[6] = 1
elif how == 'A4': b[7:11] = struct.pack('<I', 0x89006)
elif how == 'B5': b = bytearray(bytes(b).replace(b'\r\n', b'\n'))
elif how == 'B6': b = bytearray(b'\x78') + b
else:
p = 6
while p + 9 <= len(b):
ln = struct.unpack('<I', b[p+5:p+9])[0]; e = p + 11 + ln
if b[p] not in (1, 2):
if not any(b[p:]): del b[p:]
break
if e > len(b) and p + 9 + ln <= len(b):
del b[p+9+ln:]; b += struct.pack('<H', csum(b, p, ln))
elif e <= len(b) and struct.unpack('<H', b[e-2:e])[0] == csum(b, p, ln) and ends_ok(b, e): pass
else:
near = [n for n in (ln - 1, ln + 1) if n >= 0 and ok_at(b, p, n)]
if near: b[p+5:p+9] = struct.pack('<I', near[0])
elif e <= len(b) and ends_ok(b, e): b[e-2:e] = struct.pack('<H', csum(b, p, ln))
else:
wide = [n for n in sorted(range(max(0, ln - 8), ln + 9), key=lambda n: abs(n - ln)) if ok_at(b, p, n)]
if wide: b[p+5:p+9] = struct.pack('<I', wide[0])
p += 11 + struct.unpack('<I', b[p+5:p+9])[0]
return bytes(b)
if __name__ == '__main__':
open(sys.argv[3], 'wb').write(fix(open(sys.argv[1], 'rb').read(), sys.argv[2]))# 2 signature changed (A1), first byte lost (B6)
python3 dat_fix.py A1_signature_changed.dat A1 A1_fixed.dat
python3 dat_fix.py B6_first_byte_lost.dat B6 B6_fixed.dat
# 3 level wrong (A3), identifier wrong (A4)
python3 dat_fix.py A3_first_level_3.dat A3 A3_fixed.dat
# 4 length or checksum wrong (A5, A6, C2, C3)
python3 dat_fix.py C2_mid_length_plus1.dat C2 C2_fixed.dat
# 5 text mode copy (B5)
python3 dat_fix.py B5_crlf_text_mode.dat B5 B5_fixed.dat
# 6 and 7 extra bytes (B4), last checksum cut (B1, B7)
python3 dat_fix.py B1_last_byte_cut.dat B1 B1_fixed.dat
# compare with the original
sha256sum example.dat A1_fixed.dat B5_fixed.dat C2_fixed.dat | cut -c1-12
490ce41d9bec
490ce41d9bec
490ce41d9bec
490ce41d9becThe last lines compare hashes. The first 12 characters match for the original and the three repaired files, so the repaired files equal the original. Apply only the fix that matches the flag.
Check DAT files that will not open, step by step
We tested the steps on Python 3.13 and Linux. We opened no files in any mail program, and the steps keep the original untouched at every point.
- Copy your DAT file, write its SHA256 hash and work on the copy.
-
Name the type with the file command and the four kind questions. Only TNEF files start with
78 9f 3e 22. - Use our check script. A flag names the byte where your DAT file stops making sense.
- Match the flag to a cause in the table above and try its fix on the copy.
- Compare the SHA256 hash of the result with the source if you can get one, and extract with two readers.
- If one fix fails, do not stack another on top. Go back to the copy and try the next cause.
- Open the extracted files only after you trust the sender. We opened none in any mail program, so repaired files are no proof that the message displays.
What to send a helper
Short messages get faster answers. Include the details below and add the script output. Its first word gives OK, WARN or FLAG.
Subject: winmail.dat will not open
File: name, size in bytes and SHA256 hash
Kind: the output of the file command
Check: the output of dat_peek.py
Program: name, version and the exact words of the error
Source: who sent the DAT file and when it was copiedWhat no step can fix
Do not try online repair sites. Sites that offer to fix or decode any DAT file receive your upload. A message can store private plans and addresses. Try the steps above on a copy first.
Can You Extract the Attachments From a DAT File? Yes, with three tools, and they matched on 16 of 24 files
tnefparse returned 40 attachments from our 24 regular DAT files, tnef returned 35 from 21 and ytnef returned 30. The three lists matched on 16 DAT files. We compared names and file hashes, and we did not open the files.
Extracting is the main reason people open a winmail.dat file. The attachment is inside, and the mail program could not show it. FileInfo ties winmail.dat to RTF formatting from Microsoft Exchange Server.
A test with three extractors
We used all three extractors on every regular DAT file and recorded the name and a SHA256 hash of every file they wrote. The example file has AUTHORS with 244 bytes and README with 893 bytes, and tnef and ytnef wrote identical copies.
mkdir out out2
tnef -C out -f example.dat
ytnef -f out2 example.dat
sha256sum out/AUTHORS out2/AUTHORS out/README out2/README | cut -c1-12
36c47da7d118
36c47da7d118
d0f163180d6a
d0f163180d6aThe hashes match in pairs, so both tools wrote the same bytes. On the other 8 DAT files the tools split, as the study above shows. Compare two tools whenever the attachment matters.
The files an extractor cannot write
tnef refused 3 regular DAT files and wrote nothing for them. tnefparse and ytnef read all 3, but they returned different lists. Keep the DAT file, and try a second tool before you ask the sender for a new copy.
What every step is for
Keep the original file. Extract a copy and keep the DAT file you have. Check every attachment before you delete anything, because two tools can return different bytes for one attachment.
How Does a DAT File Differ From MSG, EML and ZIP Files? Close neighbors, and only one starts with 78 9f 3e 22
DAT files have close neighbors in mail. MSG files are single Outlook items, EML files are single emails as text and PST files are Outlook data files. Only a winmail.dat file starts with 78 9f 3e 22.
Several kinds of file get mixed up with winmail.dat files because they come from mail. The table lists them next to the DAT kinds. Every row ends with its source.
| Type | What separates it |
|---|---|
| Winmail.dat (TNEF) |
A stream that starts with 78 9f 3e 22. It packs the formatting and the attachments of an Outlook message. Source: Our tests and Microsoft.
|
| MSG |
One Outlook item in a compound file that starts with d0 cf 11 e0 a1 b1 1a e1. Source: Our MSG page.
|
| EML | One email stored as text, with headers and a body. Source: Our EML page. |
| PST | An Outlook data file with many items. Source: Our PST page. |
| ZIP |
A package that starts with 50 4b 03 04. FileInfo says Prison Architect DAT archives are ZIP compressed. Source: FileInfo.
|
| Text based DAT | Readable text, like the XML file used to verify Wii game dumps. Source: FileInfo. |
| Other DAT files | Game, registry and program data. FileInfo lists 17 types in all. Source: FileInfo. |
DAT or MSG
A winmail.dat file is a mail attachment that stores a message in TNEF. An MSG file is a saved Outlook item in a compound file. The first bytes separate them, because an MSG file starts with the compound file signature.
DAT or EML
An EML file stores one email as text. A winmail.dat file is binary and starts with the TNEF signature. A mail message with a TNEF part stores it as an attachment named winmail.dat, per the IANA email we read.
DAT or ZIP
A ZIP package starts with 50 4b 03 04. FileInfo says Prison Architect uses ZIP compressed DAT archives and says to rename one to .zip for 7-Zip. 7-Zip refused all 24 winmail.dat files, so that trick fits ZIP kinds and not TNEF.
Which one do you have
What Is the DAT File Format Made Of? The facts we could check, and where they came from
DAT is an ending that many makers use. Facts below come from our own checks of 24 winmail.dat files and 21 damaged copies. Sources are FileInfo, file-extensions.org, Microsoft, IANA and the Apache POI and tnefparse projects.
| Part | What we could check |
|---|---|
| Maker | FileInfo lists Microsoft for the winmail.dat kind. It lists other makers for the other 16 types. |
| Name | FileInfo lists Exchange E-mail Attachment. Microsoft titles its specification the Transport Neutral Encapsulation Format (TNEF) Data Algorithm. File-extensions.org lists no winmail.dat record. |
| First bytes |
Winmail.dat files start with 78 9f 3e 22, as our 24 regular DAT files show.
|
| Layout | A 4 byte signature, a 2 byte key and attributes. Every attribute has a level byte, a 4 byte identifier, a 4 byte length, the data and a 2 byte checksum. |
| Attributes | The first attribute is the TNEF version, 0x00089006, in all 24 DAT files. Message attributes come first, and every attachment starts with 0x00069002. |
| Checksum | The sum of the data bytes modulo 65536. 21 of our 24 regular DAT files pass it in every attribute. |
| Key | A 16 bit number. Microsoft says it must not be zero. Our 24 DAT files use 22 different keys from 8 to 60,004. |
| Sizes | Our files are 2,272 to 1,543,512 bytes long, and the median is 23,376.5 bytes. We have no size data for the other kinds. |
| Specification | Microsoft publishes MS-OXTNEF, protocol revision 15.0 dated 5/20/2025, and a page on the TNEF stream structure. |
| Media type | The file command prints application/vnd.ms-tnef for all 24 DAT files. IANA publishes a page for that type that says it needs the file name winmail.dat. We did not read the registry row, so we state no status. |
| Our tests | 24 regular DAT files, 21 damaged copies, 6 readers and 13 repairs. The file command, 7-Zip, tnefparse, tnef, ytnef and a 18 line script all read our files on Linux. |
About the values we list
Facts about the layout come from our own reading of 24 winmail.dat files and from the Microsoft pages. Facts about the other kinds come from the pages we name, and we did not test them.
Where we found no record, we say so. We found no sample of the other 16 kinds that FileInfo lists, and we read no registry row for the media type.
What we left out
We opened no DAT file in Outlook or in a decoder with a window, and we used no web viewer. We scanned no file for malware and opened none of the 40 attachments.
All 24 regular DAT files come from the Apache POI and tnefparse tests, and one more is a fuzz test file that we kept apart. Our damaged copies come from one file and change one thing at a time. Files from other mail programs can differ from ours.
Sources checked
For the kinds, see the FileInfo page on DAT files and the file-extensions.org DAT list. For the layout, see the MS-OXTNEF specification and the TNEF stream structure page.
For the media type, see the IANA media types registry. For the cause of winmail.dat attachments, see the Microsoft page on how TNEF affects email.
For the readers, see the Apache POI HMEF component, the tnefparse project page and the ytnef project page. Every count on this page came from files and scripts in our research folder.
Frequently Asked Questions About DAT Files
What is a DAT file?
A DAT file is a file with the generic ending .dat, so the ending does not name a program. FileInfo lists 17 DAT types and file-extensions.org lists 15 records. The kind most people meet is winmail.dat, which starts with the bytes 78 9f 3e 22.
What is a winmail.dat file?
A winmail.dat file is an attachment that stores an Outlook message in TNEF. Microsoft says Outlook sends a message this way when its format is Rich Text. A mail program that cannot read TNEF shows the data as an unreadable attachment.
How do I open a winmail.dat file?
FileInfo lists Outlook 365, File Viewer Plus, Encryptomatic Message Viewer Lite, Traction WinMail Decoder Pro and Winmail.dat Reader for Windows. On Linux we read 24 winmail.dat files with tnefparse, ytnef and tnef, which read 24, 24 and 21.
How do I stop getting winmail.dat attachments?
The sender controls it. Microsoft says only Rich Text messages use TNEF, and HTML and Plain Text messages do not. The sender can change the default format in the Outlook mail options, set the DisableTNEF value or change the format of one message.
Is a DAT file safe to open?
Reading the bytes starts nothing, so reading is safe. The risk lies in the attachments inside a winmail.dat file, because they can be any type. Extract them into an empty folder and open only what you expected from a sender you trust.
What is the difference between DAT and MSG?
A winmail.dat file is a TNEF stream that starts with 78 9f 3e 22. An MSG file is one Outlook item in a compound file that starts with d0 cf 11 e0. A winmail.dat file is a mail attachment, and an MSG file is a saved item.
Can I extract the attachments from a winmail.dat file?
Yes. tnefparse returned 40 attachments from our 24 regular DAT files, tnef returned 35 and ytnef returned 30. The three lists matched on 16 DAT files, so extract with two tools and compare the DAT file hashes before you rely on one.
Why will my DAT file not open?
Eight causes cover what we saw in damaged DAT files. They are the wrong kind, changed signatures, wrong levels or identifiers, wrong lengths or checksums, text mode copies, extra bytes, cut files and bad data. Our script flagged or warned on 19 of 21 damaged copies.
How can I check if a DAT file is damaged?
Read the first 16 bytes, name the type with the file command and compare two extractors. Our script also tests the key and every checksum. It passed 2 of 21 damaged copies, so only a second reader or the sender finds the rest.
Do all readers agree on a damaged DAT file?
No. Three extractors disagreed on 15 of our 21 damaged copies, and on 11 copies none of them matched the original. Only 3 copies read the same in the file command and all three extractors.
Can a damaged DAT file be repaired?
Some damage to a DAT file can be repaired. Thirteen kinds of signature, length and checksum damage came back byte for byte in our tests. Cut files and zeroed data did not, because the bytes are gone. Keep the original and work on a copy.
What MIME type is a winmail.dat file?
The file command prints application/vnd.ms-tnef for all 24 of our regular DAT files. IANA publishes a page for that type that says it needs the file name winmail.dat. We did not read the registry row, so we state no status for it.
Still Stuck With a DAT File? Eight routes out, depending on what went wrong
Read the first bytes and use the check script. The cause table lists what to try in order.
The kind questions name the kind from the first bytes, the source and the program.
Is it an Outlook message? An MSG file also stores one Outlook item, and the guide to MSG files covers it.
Is it an email as text? The guide to EML files covers the format with headers and a body.
Is it an Outlook data file? The guide to PST files covers the file with many items.
Is it a package? The guide to ZIP files covers the format behind ZIP compressed DAT archives.
Is it a file type you do not know? Browse the file extension resource library, or send it on the submit a file type page.
Do you need the format facts? Read the format part for the layout, the checksums and the sources of DAT files.