What Is a DBX File? Find the Kind, Then Open or Convert It

2 Which Kind of DBX File Is Yours? The first four bytes name the family

You need no special software. The short script below prints the start of a DBX file, the kind, the item count and the size check. Save it as check_dbx.py and give it the name of your DBX file.

import os, struct, sys

path = sys.argv[1]
size = os.path.getsize(path)
with open(path, "rb") as f:
    head = f.read(0x100)
print("First 8 bytes:", head[:8].hex(" "))
if head[:4] != bytes.fromhex("cfad12fe"):
    sys.exit("No Outlook Express signature, so this is not that kind of DBX file.")
kinds = {0xC5: "one mail folder", 0xC6: "the folder list", 0xC7: "account info", 0x30: "offline items"}
print("Holds:", kinds.get(head[4], "unknown"), "(byte 4 is %02x)" % head[4])
count = struct.unpack_from("<I", head, 0xC4)[0]
root = struct.unpack_from("<I", head, 0xE4)[0]
stated = struct.unpack_from("<I", head, 0x7C)[0]
print(f"Items in header: {count}. Index starts at byte {root}.")
print(f"Size in header: {stated} bytes. Size on disk: {size} bytes.")

python check_dbx.py inbox-3.dbx
First 8 bytes: cf ad 12 fe c5 fd 74 6f
Holds: one mail folder (byte 4 is c5)
Items in header: 3. Index starts at byte 13508.
Size in header: 13568 bytes. Size on disk: 13568 bytes.

We tried the script on all 34 test DBX files. It found the Outlook Express start in 32 and named the kind for 31. For 2 files it found no start, and for 1 it said the kind byte is unknown. The table shows the kinds of DBX files with how many every reader opened.

The Normal and Recovery columns count the DBX files from which undbx gave back at least one message in that mode. Folders.dbx has no messages, and one more DBX file was empty by design. Our DBX files are built, so a file from Outlook Express may not behave the same way.

Three more clues about your DBX file

3 What Is Inside DBX Files? A header, an index and message text in 512-byte pieces

Think of a filing cabinet with a card index. The front card says how many files are inside and where the index drawer is. The index cards point to the folders, and the folders are made of sheets that are all the same size. DBX files are built much the same way.

We read the layout from the source code of undbx, then built files to that layout and checked that two readers return our messages byte for byte. That proves our files match what those readers expect. It does not prove that Outlook Express writes the same bytes.

The header takes 9,404 bytes in every DBX file we built, so a small DBX file is mostly header. A piece takes 528 bytes. Its first 16 bytes give its own position, the length 512, the length used and the position of the next piece. Then comes up to 512 bytes of message text.

How a message is stored

Our second test message is 556 bytes long. The reader finds it through the index, reads 512 bytes from the first piece, follows the pointer to the second piece and reads the last 44 bytes. The message text is kept as it arrived, so DBX files contain ordinary mail headers, text and attachments.

A larger message has a longer chain. Our biggest message was 411,177 bytes and needed 804 pieces. An attachment is part of that text, written in base64, so it also lives in the chain.

What a deleted message leaves behind

When a message is deleted, its pieces stay in the DBX file and are only marked. The Kali page for undbx says the program can recover messages from deleted-item pieces that have not been overwritten. We built a DBX file with 5 messages and marked 2 as deleted. The normal mode of undbx returned the 3 live messages, and recovery mode also returned the 2 deleted ones, as the damage test results show.

12 What Else Uses the DBX Ending? AutoCAD files, Dropbox databases and newer mail programs

FileInfo's list of .dbx meanings names three for .dbx: an Outlook Express e-mail folder, an AutoCAD database extension file and a Dropbox encrypted database. Only the first is mail. The table adds the older mail layout that Wikipedia names.

The DBX file in a Dropbox folder

FileInfo says a Dropbox DBX file contains an encrypted database used by Dropbox. A 2013 Forensic Focus article says Dropbox began to encrypt its file cache in early 2012 and renamed filecache.db to filecache.dbx. It says a decryption tool then needed the DBX file, the Protect folder of the user, a registry value and the Windows password. It worked only for Windows XP or Vista.

So a DBX file from Dropbox is not mail, and you cannot read it by hand. Leave it for Dropbox. We did not test this kind.

The DBX file from AutoCAD

FileInfo describes the AutoCAD kind as an extension file used by AutoCAD, an engineering and design program, and names Autodesk AutoCAD as the program for it. A DBX file that came with AutoCAD or one of its add-ons belongs to that software. For drawings, the guide to AutoCAD DWG drawings covers the usual file.

Newer Microsoft mail programs

A DBX file is not what Windows Live Mail writes. The Microsoft Q&A answer on Live Mail says it keeps .eml files in folders. If you find .eml files in a Windows Live Mail folder, they are single messages, and you can open them as the section on opening files explains.

13 What Is the DBX File Format Made Of? The header facts, and what we could check

About header values we do not list

Our files also set version numbers and segment sizes in the header. We took those values from the undbx code, and we could not check them against a file from Outlook Express. So the facts table lists only the values that the two readers use to find the mail.

What we left out

We did not test Outlook Express, Windows Mail, Windows Live Mail, Outlook or Thunderbird. We did not test a DBX file over 2 GB, a newsgroup folder, an Outlook Express 4 .mbx file or any file that Microsoft software wrote. All 34 of our files came from our own scripts.

We did not test the SysTools or Freeviewer viewers or the SysTools converter. What we say about them comes from their pages. We name no prices, because the pages gave none we could check.

Our damage tests are simple breaks in small files. We tested two readers, and other readers may behave differently. The numbers in this guide show how those two behaved, and they are not rates for all DBX files.

Sources checked

For history, the 2 GB limit and the corruption problem, see Wikipedia's Outlook Express article. For the single-file-per-folder fact, see Microsoft's import note. For the other meanings of the ending, see the FileInfo entry for .dbx and the Forensic Focus article on Dropbox.

For Folders.dbx and its companions, see the ForensAfe page on Outlook Express. For the newer Microsoft programs, see the Microsoft Q&A answer on mail storage. For undbx, see the Kali tools page. Every test count came from the 34 DBX files and the scripts in our research folder.