3.2 Root File Node List

  • Article

Using the fcrFileNodeListRoot field from the preceding file header example, 0x400 bytes can be read from the file at offset 0x400. Those bytes can be read as a file node list. In this example, the list includes only four FileNodes:

  • Two ObjectSpaceManifestListReferences, one for the section object space, and one for the page object space.

  • One ObjectSpaceManifestRoot, which identifies the section object space as the root object space.

  • One FileDataStoreListReference, which specifies where the data for embedded files is stored.

    Offset

    Size

    Structure

    Value

    00000400

    0400

    FileNodeListFragment - FileNodeListFragment

    00000400

    0010

        FileNodeListHeader - header

    00000400

    0008

            UINT64 - uintMagic

    11841787174971765956

    00000408

    0004

            ULONG - FileNodeListID

    0x00000010

    0000040C

    0004

            ULONG - nFragmentSequence

    0

    00000410

    001B

        FileNode - fnd[0]

    00000410

    0004

            FileNodeHeader - header

    00000410

    10 bits

                ULONG - FileNodeID

    0x008

    00000410

    13 bits

                ULONG - Size

    27

    00000410

    2 bits

                ULONG - StpFormat

    2

    00000410

    2 bits

                ULONG - CbFormat

    2

    00000410

    4 bits

                ULONG - BaseType

    2

    00000410

    1 bit

                ULONG - Reserved

    1

    00000414

    0017

            ObjectSpaceManifestListReferenceFND - fnd

    00000414

    0003

                FileNodeListReferenceWithIndirection - ref

    00000414

    0002

                    USHORT - stp

    0x0180

    00000416

    0001

                    BYTE - cb

    0x24

    00000417

    0014

                ExtendedGUID - gosid

    {{CFDC64CA-6425-4223-903F-0B7D8A6690F9},1}

    0000042B

    0018

        FileNode - fnd[1]

    0000042B

    0004

            FileNodeHeader - header

    0000042B

    10 bits

                ULONG - FileNodeID

    0x004

    0000042B

    13 bits

                ULONG - Size

    24

    0000042B

    2 bits

                ULONG - StpFormat

    1

    0000042B

    2 bits

                ULONG - CbFormat

    0

    0000042B

    4 bits

                ULONG - BaseType

    0

    0000042B

    1 bit

                ULONG - Reserved

    1

    0000042F

    0014

            ObjectSpaceManifestRootFND - fnd

    0000042F

    0014

                ExtendedGUID - gosid

    {{CFDC64CA-6425-4223-903F-0B7D8A6690F9},1}

    00000443

    001B

        FileNode - fnd[2]

    00000443

    0004

            FileNodeHeader - header

    00000443

    10 bits

                ULONG - FileNodeID

    0x008

    00000443

    13 bits

                ULONG - Size

    27

    00000443

    2 bits

                ULONG - StpFormat

    2

    00000443

    2 bits

                ULONG - CbFormat

    2

    00000443

    4 bits

                ULONG - BaseType

    2

    00000443

    1 bit

                ULONG - Reserved

    1

    00000447

    0017

            ObjectSpaceManifestListReferenceFND - fnd

    00000447

    0003

                FileNodeListReferenceWithIndirection - ref

    00000447

    0002

                    USHORT - stp

    0x020D

    00000449

    0001

                    BYTE - cb

    0x24

    0000044A

    0014

                ExtendedGUID - gosid

    {{418BCA1D-C31E-4342-966B-B7949DA56A9F},1}

    0000045E

    0007

        FileNode - fnd[3]

    0000045E

    0004

            FileNodeHeader - header

    0000045E

    10 bits

                ULONG - FileNodeID

    0x090

    0000045E

    13 bits

                ULONG - Size

    7

    0000045E

    2 bits

                ULONG - StpFormat

    2

    0000045E

    2 bits

                ULONG - CbFormat

    2

    0000045E

    4 bits

                ULONG - BaseType

    2

    0000045E

    1 bit

                ULONG - Reserved

    1

    00000462

    0003

            FileDataStoreListReferenceFND - fnd

    00000462

    0003

                FileNodeListReferenceWithIndirection - ref

    00000462

    0002

                    USHORT - stp

    0x0509

    00000464

    0001

                    BYTE - cb

    0x24

    00000465

    0387

        Blob - padding

    0

    000007EC

    000C

        FileNodeListReferenceWithIndirection - nextFragment

    fcrNil

    000007F8

    0008

        UINT64 - footer

    10070635646201084491

header.FileNodeListID: 0x00000010 specifies that an identifier for this file node list. All FileNodeListFragments that are part of this list need to share this identifier.

header.nFragmentSequence: Zero specifies that this is the first fragment in this file node list.

fnd[0]: This FileNode establishes that there is an object space and gives the location in the file in which the object space’s revision manifest list resides.

fnd[0].header.FileNodeID: 0x008 specifies that this FileNode is of type "ObjectSpaceManifestListReferenceFND".

fnd[0].header.Size: 27 specifies that in addition to the 4 bytes of FileNodeHeader, there are 23 bytes of data. The next FileNode, if any, occurs immediately afterwards.

fnd[0].header.StpFormat: 2 specifies that if this FileNode type contains a file offset reference to another part of the file, the reference is compressed into 2 bytes, and the actual byte offset is 8 times that value.

fnd[0].header.CbFormat: 2 specifies that if this FileNode type contains a file offset reference to another part of the file, the size is compressed into 1 byte, and the actual byte length is 8 times that value.

fnd[0].header.BaseType: 2 specifies that this FileNode does indeed contain a file offset reference to another part of the file, and that a file node list is found at that offset.

fnd[0].fnd.ref:  Specifies that the first fragment of the object space manifest file node list is located at offset 0xC00 in the file (0x180 ×8), and is 0x120 bytes in length (0x24 ×8).

fnd[0].fnd.gosid: {CFDC64CA-6425-4223-903F-0B7D8A6690F9},1} specifies the identity of the object space.

fnd[1]: This FileNode identifies the object space specified in fnd[0] as the root object space for this file.

fnd[1].header: Specifies that the FileNode is of type ObjectSpaceManifestRootFND, that it contains 20 bytes of data beyond the header, and that it does not contain a reference to another part of the file.

fnd[1].fnd.gosid: {{CFDC64CA-6425-4223-903F-0B7D8A6690F9},1} specifies that the object space identified by this gosid is the root object space for the entire file. This identity matches the gosid in the previous ObjectSpaceManifestListReferenceFND FileNode.

fnd[2]: This FileNode establishes that there is another object space, and gives the location in the file where the object space’s revision manifest list resides.

fnd[2].header: Specifies that the FileNode is of type "ObjectSpaceManifestListReferenceFND", that it contains 23 bytes of data beyond the header, that the data begins with a compressed reference to another part of the file, and that a file node list can be found at that other file location.

fnd[2].fnd.ref: Specifies that the first fragment of the object space manifest file node list is located at offset 0x1068 in the file, and is 0x120 bytes in length.

fnd[2].fnd.gosid: {{418BCA1D-C31E-4342-966B-B7949DA56A9F},1} specifies the identity of this second object space.

fnd[3]: This FileNode establishes that there is file data store in the file, and gives its location in the file.

fnd[3].header: Specifies that the FileNode is of type "FileDataStoreListReferenceFND", that it contains 3 bytes of data beyond the header, that the data begins with a compressed reference to another part of the file, and that a file node list can be found at that other file location.

fnd[3].fnd.ref: Specifies that the first fragment of the file data store list is located at offset 0x2848 in the file, and is 0x120 bytes in length.

nextFragment: "fcrNil" specifies that there are no additional fragments in this file node list.