Export (0) Print
Expand All

3.1 File Header

Office

The following is an example of a Header structure (section 2.3.1) for a .one file.

Offset

Size

Structure

Value

000001F8

0400

FileNodeHeader - FileNodeHeader

00000000

0010

    GUID - guidFileType

{7B5C52E4-D88C-4DA7-AEB1-5378D02996D3}

00000010

0010

    GUID - guidFile

{8DFAB807-A83A-4AC0-9393-E1DD0691CFB8}

00000020

0010

    GUID - guidLegacyFileVersion

{00000000-0000-0000-0000-000000000000}

00000030

0010

    GUID - guidFileFormat

{109ADD3F-911B-49F5-A5D0-1791EDC8AED8}

00000040

0004

    FileFormatVersion - ffvLastCodeThatWroteToThisFile

42

00000044

0004

    FileFormatVersion - ffvOldestCodeThatHasWrittenToThisFile

42

00000048

0004

    FileFormatVersion - ffvNewestCodeThatHasWrittenToThisFile

42

0000004C

0004

    FileFormatVersion - ffvOldestCodeThatMayReadThisFile

42

00000050

0008

    FileChunkReference32- fcrLegacyFreeChunkList

00000050

0004

        ULONG - stp

0x00000000

00000054

0004

        ULONG - cb

0x00000000

00000058

0008

    FileChunkReference32 - fcrLegacyTransactionLog

00000058

0004

        ULONG - stp

0xFFFFFFFF

0000005C

0004

        ULONG - cb

0x00000000

00000060

0004

    ULONG - cTransactionsInLog

15

00000064

0004

    ULONG - cbLegacyExpectedFileLength

0

00000068

0008

    UINT64 - rgbPlaceholder

0

00000070

0008

    FileChunkReference32 - fcrLegacyFileNodeListRoot

00000070

0004

        ULONG - stp

0xFFFFFFFF

00000074

0004

        ULONG - cb

0x00000000

00000078

0004

    ULONG - cbLegacyFreeSpaceInFreeChunkList

0

0000007C

0001

    BYTE - fNeedsDefrag

0

0000007D

0001

    BYTE - fRepairedFile

0

0000007E

0001

    BYTE - fNeedsGarbageCollect

0

0000007F

0001

    BYTE - fHasNoEmbeddedFileObjects

0

00000080

0010

    GUID - guidAncestor

{E2FA6D4F-08F1-4E6B-B156-0EDFB16FB083}

00000090

0004

    ULONG - crcName

0xCEBE8422

00000094

000C

    FileNodeListFragmentReference64x32 - fcrHashedChunkList

00000094

0008

        UINT64 - stp

0x00000000000012A8

00000098

0004

        ULONG - cb

0x00000400

000000A0

000C

    TransactionLogFragmentReference64x32 - fcrTransactionLog

000000A0

0008

        UINT64 - stp

0x0000000000000800

000000A8

0004

        ULONG - cb

0x00000400

000000AC

000C

    FileNodeListFragmentReference64x32 - fcrFileNodeListRoot

000000AC

0008

        UINT64 - stp

0x0000000000000400

000000B4

0004

        ULONG - cb

0x00000400

000000B8

000C

    FreeChunkListChunkReference - fcrFreeChunkList

000000B8

0008

        UINT64 - stp

18446744073709551615

000000C0

0004

        ULONG - cb

0x00000000

000000C4

0008

    UINT64 - cbExpectedFileLength

0x0000000000003190

000000CC

0008

    UINT64 - cbFreeSpaceInFreeChunkList

0x0000000000000000

000000D4

0010

    GUID - guidFileVersion

{A9E957F9-A065-4E7D-AFB3-96B7311504DF}

000000E4

0008

    UINT64 - nFileVersionGeneration

15

000000EC

0010

    GUID - guidDenyReadFileVersion

{A8EE13E0-7E37-46D4-BA83-AB3248782D16}

000000FC

0004

    ULONG - grfDebugLogFlags

0

00000100

000C

    FileChunkReference64x32- fcrDebugLog

00000100

0008

        UINT64 - stp

0x0000000000000000

00000108

0004

        ULONG - cb

0x00000000

0000010C

000C

    FileChunkReference64x32 - fcrAllocVerificationFreeChunkList

0000010C

0008

        UINT64 - stp

0x0000000000000000

00000114

0004

        ULONG - cb

0x00000000

00000118

0004

    BuildNumber - bnCreated

0x0FA129B4

0000011C

0004

    BuildNumber - bnLastWroteToThisFile

0x0FA129B4

00000120

0004

    BuildNumber - bnOldestWritten

0x0FA129B4

00000124

0004

    BuildNumber - bnNewestWritten

0x0FA129B4

00000128

02D8

    FixedBlob - rgbReserved

0

guidFileType: "{7B5C52E4-D88C-4DA7-AEB1-5378D02996D3}" specifies that the file format is .one, rather than .onetoc2.

guidFile: This GUID provides a unique identity for each file.

guidFileFormat: {109ADD3F-911B-49F5-A5D0-1791EDC8AED8} identifies this file as a OneNote Revision Store.

ffvLastCodeThatWroteToThisFile: 42 specifies that the file format is from Microsoft OneNote 2010.

ffvOldestCodeThatHasWrittenToThisFile: 42 specifies that the file format is from OneNote 2010.

ffvNewestCodeThatHasWrittenToThisFile: 42 specifies that the file format is from OneNote 2010.

ffvOldestCodeThatMayReadThisFile: 42 specifies that versions of OneNote older than OneNote 2010 cannot read this file.

cTransactionsInLog: 15 specifies that the first 15 entries in the transaction log are complete. Any additional entries are not yet ready and are ignored.

fHasNoEmbeddedFileObjects: Always set to 0, even when the file indeed contains no embedded file objects.

guidAncestor: This GUID matches the guidFile field of the .onetoc2 file in the same directory as this .one file.

crcName: 0xCEBE8422 is the CRC that is derived from the section name "Example.one".

fcrHashedChunkList: Specifies that the hashed chunk list is located at offset 0x12a8 in the file, and is 0x400 bytes in length.

fcrTransactionLog: Specifies that the first fragment of the transaction log is located at offset 0x800 in the file, and is 0x400 bytes in length.

fcrFileNodeListRoot: Specifies that the first fragment of the root file node list is located at offset 0x400 in the file, and is 0x400 bytes in length.

fcrFreeChunkList: "fcrNil" specifies that there is no free chunk list in this file.

cbExpectedFileLength: 0x3190 -- matches the byte size of this file.

cbFreeSpaceInFreeChunkList: This field is zero, because the file contains no free chunk list.

guidFileVersion: This is a unique GUID, created when this file was last modified.

nFileVersionGeneration: 15 indicates the number of times this file has been modified. It coincides with cTransactionsInLog, so each modification adds a new log entry, but the two numbers do not need to be in sync.

guidDenyReadFileVersion: This is a unique GUID, created during a recent modification to the file.

bnCreated: 0x0FA129B4 indicates OneNote 2010 build number 14.0.4763.1000.

bnLastWroteToThisFile: 0x0FA129B4 indicates OneNote 2010 build number 14.0.4763.1000.

bnOldestWritten: 0x0FA129B4 indicates OneNote 2010 build number 14.0.4763.1000.

bnNewestWritten: 0x0FA129B4 indicates OneNote 2010 build number 14.0.4763.1000.

Show:
© 2014 Microsoft