I'm trying to understand the format and specifications of Outlook Ole Attachments at the compound file level of things, the Ole Attachment in hand is a Picture (Device Independent Bitmap), I produced the Msg file by composing RTF text email with inline picture within the body text.
Opening the msg file using Structured Storage Explorer (a tool by Microsoft), I can see the attachment substorage:
I understand the structure of the Ole Attachment Object, but what I can't find anywhere is the format of the MailStream stream within the substorage. I'm asking if anyone knows the format or can point me to the documentation that helps in this case. I'm asking specifically about the MailStream, please do not answer pointing to how compound files specifications are or something similar. Thanks in advance.
As far as I know, the first 4 bytes are dwAspect. The next 2 DWORDs are width and height.
BTW, you don't have to use Structured Storage Explorer - you can see the data in OutlookSpy (I am its author): click IMessage button, go to the GetAttachmentTable tab, double click on the attachment, select PR_ATTACH_DATA_OBJ, right click, select IMAPIProp::OpenProperty, select IID_IStorage.