Difference between revisions of "Extensible Storage Engine (ESE) Database File (EDB) format"

From ForensicsWiki
Jump to: navigation, search
(External Links)
(Tools)
(7 intermediate revisions by the same user not shown)
Line 42: Line 42:
 
* Instant Messaging
 
* Instant Messaging
 
* Windows (Vista) Mail
 
* Windows (Vista) Mail
* Content Indexing/Windows (Desktop) Search
+
* [[Windows Desktop Search|Content Indexing/Windows (Desktop) Search]]
  
 
== External Links ==
 
== External Links ==
  
* [http://code.google.com/p/libesedb/downloads/detail?name=Extensible%20Storage%20Engine%20%28ESE%29%20Database%20File%20%28EDB%29%20format.pdf Extensible Storage Engine (ESE) Database File (EDB) format], by [[libesedb|libesedb project]]
+
* [http://code.google.com/p/libesedb/downloads/detail?name=Extensible%20Storage%20Engine%20%28ESE%29%20Database%20File%20%28EDB%29%20format.pdf Extensible Storage Engine (ESE) Database File (EDB) format], by the [[libesedb|libesedb project]]
 
* [http://en.wikipedia.org/wiki/Extensible_Storage_Engine Wikipedia on Extensible Storage Engine]
 
* [http://en.wikipedia.org/wiki/Extensible_Storage_Engine Wikipedia on Extensible Storage Engine]
* [https://www.os3.nl/_media/2008-2009/students/willem_toorop/wlm2009_ese_fin.pdf Forensic examination of Windows Live Messenger 2009 Extensible Storage Engine], May 2009 by [[Wouter van Dongen]], [[Willem Toorop]], [[Joeri Blokhuis]]
+
* [https://www.os3.nl/_media/2008-2009/students/willem_toorop/wlm2009_ese_fin.pdf Forensic examination of Windows Live Messenger 2009 Extensible Storage Engine], by [[Wouter van Dongen]], [[Willem Toorop]], [[Joeri Blokhuis]], May 2009
  
 
== Tools ==
 
== Tools ==
 
* [http://www.woanware.co.uk/?page_id=89 EsEDbViewer]
 
* [http://www.woanware.co.uk/?page_id=89 EsEDbViewer]
 
* [[libesedb]]
 
* [[libesedb]]
 +
 +
Tools that are provided with the ESE engine:
 +
* '''eseutil''' (comes with [[Exchange server]]) or '''esentutl''' (comes with a [[Windows|Windows NT]] variant which has the ESE engine)
  
 
[[Category:File Formats]]
 
[[Category:File Formats]]

Revision as of 01:29, 30 July 2012

Microsoft uses the Extensible Storage Engine (ESE) Database File (EDB) format for multiple purposes.

MIME types

The actual mime type of the ESDEB format is unspecified

File signature

The ESEDB has the following file signature: hexadecimal: ef cd ab 89 (at offset 4)

File types

ESEDB distinguishes between the following types:

  • database (.edb, .sdb, ...)
  • streaming file (.stm)

There are also multiple versions of the ESEDB format.

Contents

The ESEDB basically is an ISAM database file format.

The ESEDB format is used by many Microsoft applications to store data such as:

  • Active Directory (NTDS)
  • File Replication service (FRS)
  • Windows Internet Name service (WINS)
  • DHCP
  • Security Configuration Engine (SCE)
  • Certificate Server
  • Terminal Services Session folder
  • Terminal Services Licensing service
  • Catalog database
  • Help and Support Services
  • Directory Synchronization service (MSDSS)
  • Remote Storage (RSS)
  • Phone Book service
  • Single Instance Store (SIS) Groveler
  • Windows NT Backup/Restore
  • Exchange store
  • Microsoft Exchange folder (SRS and DXA)
  • Key Management service (KMS)
  • Instant Messaging
  • Windows (Vista) Mail
  • Content Indexing/Windows (Desktop) Search

External Links

Tools

Tools that are provided with the ESE engine: