3.2 Root File Node List

Office

Using the fcrFileNodeListRoot field from the preceding file header example, 0x400 bytes can be read from the file at offset 0x400. Those bytes can be read as a file node list. In this example, the list includes only four FileNodes:

  • Two ObjectSpaceManifestListReferences, one for the section object space, and one for the page object space.

  • One ObjectSpaceManifestRoot, which identifies the section object space as the root object space.

  • One FileDataStoreListReference, which specifies where the data for embedded files is stored.

    Offset

    Size

    Structure

    Value

    00000400

    0400

    FileNodeListFragment - FileNodeListFragment

    00000400

    0010

        FileNodeListHeader - header

    00000400

    0008

            UINT64 - uintMagic

    11841787174971765956

    00000408

    0004

            ULONG - FileNodeListID

    0x00000010

    0000040C

    0004

            ULONG - nFragmentSequence

    0

    00000410

    001B

        FileNode - fnd[0]

    00000410

    0004

            FileNodeHeader - header

    00000410

    10 bits

                ULONG - FileNodeID

    0x008

    00000410

    13 bits

                ULONG - Size

    27

    00000410

    2 bits

                ULONG - StpFormat

    2

    00000410

    2 bits

                ULONG - CbFormat

    2

    00000410

    4 bits

                ULONG - BaseType

    2

    00000410

    1 bit

                ULONG - Reserved

    1

    00000414

    0017

            ObjectSpaceManifestListReferenceFND - fnd

    00000414

    0003

                FileNodeListReferenceWithIndirection - ref

    00000414

    0002

                    USHORT - stp

    0x0180

    00000416

    0001

                    BYTE - cb

    0x24

    00000417

    0014

                ExtendedGUID - gosid

    {{CFDC64CA-6425-4223-903F-0B7D8A6690F9},1}

    0000042B

    0018

        FileNode - fnd[1]

    0000042B

    0004

            FileNodeHeader - header

    0000042B

    10 bits

                ULONG - FileNodeID

    0x004

    0000042B

    13 bits

                ULONG - Size

    24

    0000042B

    2 bits

                ULONG - StpFormat

    1

    0000042B

    2 bits

                ULONG - CbFormat

    0

    0000042B

    4 bits

                ULONG - BaseType

    0

    0000042B

    1 bit

                ULONG - Reserved

    1

    0000042F

    0014

            ObjectSpaceManifestRootFND - fnd

    0000042F

    0014

                ExtendedGUID - gosid

    {{CFDC64CA-6425-4223-903F-0B7D8A6690F9},1}

    00000443

    001B

        FileNode - fnd[2]

    00000443

    0004

            FileNodeHeader - header

    00000443

    10 bits

                ULONG - FileNodeID

    0x008

    00000443

    13 bits

                ULONG - Size

    27

    00000443

    2 bits

                ULONG - StpFormat

    2

    00000443

    2 bits

                ULONG - CbFormat

    2

    00000443

    4 bits

                ULONG - BaseType

    2

    00000443

    1 bit

                ULONG - Reserved

    1

    00000447

    0017

            ObjectSpaceManifestListReferenceFND - fnd

    00000447

    0003

                FileNodeListReferenceWithIndirection - ref

    00000447

    0002

                    USHORT - stp

    0x020D

    00000449

    0001

                    BYTE - cb

    0x24

    0000044A

    0014

                ExtendedGUID - gosid

    {{418BCA1D-C31E-4342-966B-B7949DA56A9F},1}

    0000045E

    0007

        FileNode - fnd[3]

    0000045E

    0004

            FileNodeHeader - header

    0000045E

    10 bits

                ULONG - FileNodeID

    0x090

    0000045E

    13 bits

                ULONG - Size

    7

    0000045E

    2 bits

                ULONG - StpFormat

    2

    0000045E

    2 bits

                ULONG - CbFormat

    2

    0000045E

    4 bits

                ULONG - BaseType

    2

    0000045E

    1 bit

                ULONG - Reserved

    1

    00000462

    0003

            FileDataStoreListReferenceFND - fnd

    00000462

    0003

                FileNodeListReferenceWithIndirection - ref

    00000462

    0002

                    USHORT - stp

    0x0509

    00000464

    0001

                    BYTE - cb

    0x24

    00000465

    0387

        Blob - padding

    0

    000007EC

    000C

        FileNodeListReferenceWithIndirection - nextFragment

    fcrNil

    000007F8

    0008

        UINT64 - footer

    10070635646201084491

header.FileNodeListID: 0x00000010 specifies that an identifier for this file node list. All FileNodeListFragments that are part of this list need to share this identifier.

header.nFragmentSequence: Zero specifies that this is the first fragment in this file node list.

fnd[0]: This FileNode establishes that there is an object space and gives the location in the file in which the object space’s revision manifest list resides.

fnd[0].header.FileNodeID: 0x008 specifies that this FileNode is of type "ObjectSpaceManifestListReferenceFND".

fnd[0].header.Size: 27 specifies that in addition to the 4 bytes of FileNodeHeader, there are 23 bytes of data. The next FileNode, if any, occurs immediately afterwards.

fnd[0].header.StpFormat: 2 specifies that if this FileNode type contains a file offset reference to another part of the file, the reference is compressed into 2 bytes, and the actual byte offset is 8 times that value.

fnd[0].header.CbFormat: 2 specifies that if this FileNode type contains a file offset reference to another part of the file, the size is compressed into 1 byte, and the actual byte length is 8 times that value.

fnd[0].header.BaseType: 2 specifies that this FileNode does indeed contain a file offset reference to another part of the file, and that a file node list is found at that offset.

fnd[0].fnd.ref:  Specifies that the first fragment of the object space manifest file node list is located at offset 0xC00 in the file (0x180 ×8), and is 0x120 bytes in length (0x24 ×8).

fnd[0].fnd.gosid: {CFDC64CA-6425-4223-903F-0B7D8A6690F9},1} specifies the identity of the object space.

fnd[1]: This FileNode identifies the object space specified in fnd[0] as the root object space for this file.

fnd[1].header: Specifies that the FileNode is of type ObjectSpaceManifestRootFND, that it contains 20 bytes of data beyond the header, and that it does not contain a reference to another part of the file.

fnd[1].fnd.gosid: {{CFDC64CA-6425-4223-903F-0B7D8A6690F9},1} specifies that the object space identified by this gosid is the root object space for the entire file. This identity matches the gosid in the previous ObjectSpaceManifestListReferenceFND FileNode.

fnd[2]: This FileNode establishes that there is another object space, and gives the location in the file where the object space’s revision manifest list resides.

fnd[2].header: Specifies that the FileNode is of type "ObjectSpaceManifestListReferenceFND", that it contains 23 bytes of data beyond the header, that the data begins with a compressed reference to another part of the file, and that a file node list can be found at that other file location.

fnd[2].fnd.ref: Specifies that the first fragment of the object space manifest file node list is located at offset 0x1068 in the file, and is 0x120 bytes in length.

fnd[2].fnd.gosid: {{418BCA1D-C31E-4342-966B-B7949DA56A9F},1} specifies the identity of this second object space.

fnd[3]: This FileNode establishes that there is file data store in the file, and gives its location in the file.

fnd[3].header: Specifies that the FileNode is of type "FileDataStoreListReferenceFND", that it contains 3 bytes of data beyond the header, that the data begins with a compressed reference to another part of the file, and that a file node list can be found at that other file location.

fnd[3].fnd.ref: Specifies that the first fragment of the file data store list is located at offset 0x2848 in the file, and is 0x120 bytes in length.

nextFragment: "fcrNil" specifies that there are no additional fragments in this file node list.

Show: