Was this page helpful?
Your feedback about this content is important. Let us know what you think.
Additional feedback?
1500 characters remaining
3.2 Root File Node List
Collapse the table of content
Expand the table of content

3.2 Root File Node List

Office

Using the fcrFileNodeListRoot field from the preceding file header example, 0x400 bytes can be read from the file at offset 0x400. Those bytes can be read as a file node list. In this example, the list includes only four FileNodes:

  • Two ObjectSpaceManifestListReferences, one for the section object space, and one for the page object space.

  • One ObjectSpaceManifestRoot, which identifies the section object space as the root object space.

  • One FileDataStoreListReference, which specifies where the data for embedded files is stored.

Offset

Size

Structure

Value

00000400

0400

FileNodeListFragment - FileNodeListFragment

00000400

0010

    FileNodeListHeader- header

00000400

0008

        UINT64 - uintMagic

11841787174971765956

00000408

0004

        ULONG - FileNodeListID

0x00000010

0000040C

0004

        ULONG - nFragmentSequence

0

00000410

001B

    FileNode- fnd[0]

00000410

0004

        FileNodeHeader - header

00000410

10 bits

            ULONG - FileNodeID

0x008

00000410

13 bits

            ULONG - Size

27

00000410

2 bits

            ULONG - StpFormat

2

00000410

2 bits

            ULONG - CbFormat

2

00000410

4 bits

            ULONG - BaseType

2

00000410

1 bit

            ULONG - Reserved

1

00000414

0017

        ObjectSpaceManifestListReferenceFND- fnd

00000414

0003

            FileNodeListReferenceWithIndirection - ref

00000414

0002

                USHORT - stp

0x0180

00000416

0001

                BYTE - cb

0x24

00000417

0014

            ExtendedGUID- gosid

{{CFDC64CA-6425-4223-903F-0B7D8A6690F9},1}

0000042B

0018

    FileNode - fnd[1]

0000042B

0004

        FileNodeHeader - header

0000042B

10 bits

            ULONG - FileNodeID

0x004

0000042B

13 bits

            ULONG - Size

24

0000042B

2 bits

            ULONG - StpFormat

1

0000042B

2 bits

            ULONG - CbFormat

0

0000042B

4 bits

            ULONG - BaseType

0

0000042B

1 bit

            ULONG - Reserved

1

0000042F

0014

        ObjectSpaceManifestRootFND- fnd

0000042F

0014

            ExtendedGUID - gosid

{{CFDC64CA-6425-4223-903F-0B7D8A6690F9},1}

00000443

001B

    FileNode - fnd[2]

00000443

0004

        FileNodeHeader - header

00000443

10 bits

            ULONG - FileNodeID

0x008

00000443

13 bits

            ULONG - Size

27

00000443

2 bits

            ULONG - StpFormat

2

00000443

2 bits

            ULONG - CbFormat

2

00000443

4 bits

            ULONG - BaseType

2

00000443

1 bit

            ULONG - Reserved

1

00000447

0017

        ObjectSpaceManifestListReferenceFND - fnd

00000447

0003

            FileNodeListReferenceWithIndirection - ref

00000447

0002

                USHORT - stp

0x020D

00000449

0001

                BYTE - cb

0x24

0000044A

0014

            ExtendedGUID - gosid

{{418BCA1D-C31E-4342-966B-B7949DA56A9F},1}

0000045E

0007

    FileNode - fnd[3]

0000045E

0004

        FileNodeHeader - header

0000045E

10 bits

            ULONG - FileNodeID

0x090

0000045E

13 bits

            ULONG - Size

7

0000045E

2 bits

            ULONG - StpFormat

2

0000045E

2 bits

            ULONG - CbFormat

2

0000045E

4 bits

            ULONG - BaseType

2

0000045E

1 bit

            ULONG - Reserved

1

00000462

0003

        FileDataStoreListReferenceFND- fnd

00000462

0003

            FileNodeListReferenceWithIndirection - ref

00000462

0002

                USHORT - stp

0x0509

00000464

0001

                BYTE - cb

0x24

00000465

0387

    Blob - padding

0

000007EC

000C

    FileNodeListReferenceWithIndirection - nextFragment

fcrNil

000007F8

0008

    UINT64 - footer

10070635646201084491

header.FileNodeListID: 0x00000010 specifies that an identifier for this file node list. All FileNodeListFragments that are part of this list need to share this identifier.

header.nFragmentSequence: Zero specifies that this is the first fragment in this file node list.

fnd[0]: This FileNode establishes that there is an object space and gives the location in the file in which the object space’s revision manifest list resides.

fnd[0].header.FileNodeID: 0x008 specifies that this FileNode is of type "ObjectSpaceManifestListReferenceFND".

fnd[0].header.Size: 27 specifies that in addition to the 4 bytes of FileNodeHeader, there are 23 bytes of data. The next FileNode, if any, occurs immediately afterwards.

fnd[0].header.StpFormat: 2 specifies that if this FileNode type contains a file offset reference to another part of the file, the reference is compressed into 2 bytes, and the actual byte offset is 8 times that value.

fnd[0].header.CbFormat: 2 specifies that if this FileNode type contains a file offset reference to another part of the file, the size is compressed into 1 byte, and the actual byte length is 8 times that value.

fnd[0].header.BaseType: 2 specifies that this FileNode does indeed contain a file offset reference to another part of the file, and that a file node list is found at that offset.

fnd[0].fnd.ref: Specifies that the first fragment of the object space manifest file node list is located at offset 0xC00 in the file (0x180 ×8), and is 0x120 bytes in length (0x24 ×8).

fnd[0].fnd.gosid: {CFDC64CA-6425-4223-903F-0B7D8A6690F9},1} specifies the identity of the object space.

fnd[1]: This FileNode identifies the object space specified in fnd[0] as the root object space for this file.

fnd[1].header: Specifies that the FileNode is of type ObjectSpaceManifestRootFND, that it contains 20 bytes of data beyond the header, and that it does not contain a reference to another part of the file.

fnd[1].fnd.gosid: {{CFDC64CA-6425-4223-903F-0B7D8A6690F9},1} specifies that the object space identified by this gosid is the root object space for the entire file. This identity matches the gosid in the previous ObjectSpaceManifestListReferenceFND FileNode.

fnd[2]: This FileNode establishes that there is another object space, and gives the location in the file where the object space’s revision manifest list resides.

fnd[2].header: Specifies that the FileNode is of type "ObjectSpaceManifestListReferenceFND", that it contains 23 bytes of data beyond the header, that the data begins with a compressed reference to another part of the file, and that a file node list can be found at that other file location.

fnd[2].fnd.ref: Specifies that the first fragment of the object space manifest file node list is located at offset 0x1068 in the file, and is 0x120 bytes in length.

fnd[2].fnd.gosid: {{418BCA1D-C31E-4342-966B-B7949DA56A9F},1} specifies the identity of this second object space.

fnd[3]: This FileNode establishes that there is file data store in the file, and gives its location in the file.

fnd[3].header: Specifies that the FileNode is of type "FileDataStoreListReferenceFND", that it contains 3 bytes of data beyond the header, that the data begins with a compressed reference to another part of the file, and that a file node list can be found at that other file location.

fnd[3].fnd.ref: Specifies that the first fragment of the file data store list is located at offset 0x2848 in the file, and is 0x120 bytes in length.

nextFragment: "fcrNil" specifies that there are no additional fragments in this file node list.

Show:
© 2015 Microsoft