InfiniTec - Henning Krauses Blog

Don't adjust your mind - it's reality that is malfunctioning

Exchange 2007 Attachment identifiers demystified

In this article I demonstrated how to construct OWA urls from a WebDAV item. If you look at the address of an attachment in a mail of an Exchange 2007 item, you'll notice that it shares a common part. Here is the address of an item in my lab Exchange:

    1 https://w2k3x64/owa/?ae=Item&a=Preview&t=IPM.Note&id=RgAAAADJ6AAdAckcS7lYLU8HPEIRBwBgW74qsZ7RTJzeGdXyv4QaAVQHuk8vAABgW74qsZ7RTJzeGdXyv4QaAVQHulWAAAAJ

The first attachment of this mail has the following address:

    1 https://w2k3x64/owa/attachment.ashx?attach=1&id=RgAAAADJ6AAdAckcS7lYLU8HPEIRBwBgW74qsZ7RTJzeGdXyv4QaAVQHuk8vAABgW74qsZ7RTJzeGdXyv4QaAVQHulWAAAAJ&attid0=EAA2S%2fWIlTJ7S6U0djIHXKRH&attcnt=1

You'll notice that the id parameter is the same for both, the mail and the attachment. As outlined in the above article, this is a modified form of the PR_ENTRYID property. The identifier fro the attachment is specified in the attid0 parameter. This parameter is the url encoded and base64 encoded value of the PR_RECORD_KEY ( property.

Now, if you issue a X-MS-ENUMATTS request on the address of the item, you won't get this property. The trick is to issue a PROPFIND on the address of the attachment which you got from the X-MS-ENUMATTS request. But you should not request all properties from the request, because one of them is the property which contains the entire attachment as base64 encoded string. Instead, just request the PR_RECORDKEY. If the item has more than one attachment, you can use the BPROPFIND to get the record keys of all items at once.

Once you  have the record key as base64 string you'll have to perform these steps to derive the attId0 parameter:

  1. Decode the base64 string to a byte array
  2. Create a new byte array with a length of the decoded record key plus 2
  3. Write the length of the byte array to the first two bytes of the new byte array.
  4. Copy the byte array containing the record to the new array starting at offset 2
  5. Perform a base64 encoding on the newly created byte array
  6. Perform a urlencode on that string

The result is a string that you can use for the attId0 parameter. Both, the attach and the attcnt property seem to be always 1.


Posted by Henning Krause on Thursday, July 26, 2007 12:00 AM, last modified on Friday, April 22, 2011 6:48 PM
Permalink | Post RSSRSS comment feed

Comments (2) -

On 4/22/2011 6:48:13 PM Gary Comstock United States wrote:

Gary Comstock

This is really great but can you get the attid0 parameter using EWS?

On 8/26/2014 12:00:44 PM Chris wrote:


Thanks for the great article. I am getting wrong attid0  with the procedure only first three letter are matching.

Something like actual attid0 is BAABAAAA with this with this procedure I am getting BAA0UZ/o

Can you please help me out to resolve this problem.