3.1 File Header
The following is an example of a Header structure (section 2.3.1) for a .one file.
|
Offset |
Size |
Structure |
Value |
|---|---|---|---|
|
000001F8 |
0400 |
FileNodeHeader - FileNodeHeader |
|
|
00000000 |
0010 |
GUID - guidFileType |
{7B5C52E4-D88C-4DA7-AEB1-5378D02996D3} |
|
00000010 |
0010 |
GUID - guidFile |
{8DFAB807-A83A-4AC0-9393-E1DD0691CFB8} |
|
00000020 |
0010 |
GUID - guidLegacyFileVersion |
{00000000-0000-0000-0000-000000000000} |
|
00000030 |
0010 |
GUID - guidFileFormat |
{109ADD3F-911B-49F5-A5D0-1791EDC8AED8} |
|
00000040 |
0004 |
FileFormatVersion - ffvLastCodeThatWroteToThisFile |
42 |
|
00000044 |
0004 |
FileFormatVersion - ffvOldestCodeThatHasWrittenToThisFile |
42 |
|
00000048 |
0004 |
FileFormatVersion - ffvNewestCodeThatHasWrittenToThisFile |
42 |
|
0000004C |
0004 |
FileFormatVersion - ffvOldestCodeThatMayReadThisFile |
42 |
|
00000050 |
0008 |
FileChunkReference32 - fcrLegacyFreeChunkList |
|
|
00000050 |
0004 |
ULONG - stp |
0x00000000 |
|
00000054 |
0004 |
ULONG - cb |
0x00000000 |
|
00000058 |
0008 |
FileChunkReference32 - fcrLegacyTransactionLog |
|
|
00000058 |
0004 |
ULONG - stp |
0xFFFFFFFF |
|
0000005C |
0004 |
ULONG - cb |
0x00000000 |
|
00000060 |
0004 |
ULONG - cTransactionsInLog |
15 |
|
00000064 |
0004 |
ULONG - cbLegacyExpectedFileLength |
0 |
|
00000068 |
0008 |
UINT64 - rgbPlaceholder |
0 |
|
00000070 |
0008 |
FileChunkReference32 - fcrLegacyFileNodeListRoot |
|
|
00000070 |
0004 |
ULONG - stp |
0xFFFFFFFF |
|
00000074 |
0004 |
ULONG - cb |
0x00000000 |
|
00000078 |
0004 |
ULONG - cbLegacyFreeSpaceInFreeChunkList |
0 |
|
0000007C |
0001 |
BYTE - fNeedsDefrag |
0 |
|
0000007D |
0001 |
BYTE - fRepairedFile |
0 |
|
0000007E |
0001 |
BYTE - fNeedsGarbageCollect |
0 |
|
0000007F |
0001 |
BYTE - fHasNoEmbeddedFileObjects |
0 |
|
00000080 |
0010 |
GUID - guidAncestor |
{E2FA6D4F-08F1-4E6B-B156-0EDFB16FB083} |
|
00000090 |
0004 |
ULONG - crcName |
0xCEBE8422 |
|
00000094 |
000C |
FileNodeListFragmentReference64x32 - fcrHashedChunkList |
|
|
00000094 |
0008 |
UINT64 - stp |
0x00000000000012A8 |
|
00000098 |
0004 |
ULONG - cb |
0x00000400 |
|
000000A0 |
000C |
TransactionLogFragmentReference64x32 - fcrTransactionLog |
|
|
000000A0 |
0008 |
UINT64 - stp |
0x0000000000000800 |
|
000000A8 |
0004 |
ULONG - cb |
0x00000400 |
|
000000AC |
000C |
FileNodeListFragmentReference64x32 - fcrFileNodeListRoot |
|
|
000000AC |
0008 |
UINT64 - stp |
0x0000000000000400 |
|
000000B4 |
0004 |
ULONG - cb |
0x00000400 |
|
000000B8 |
000C |
FreeChunkListChunkReference - fcrFreeChunkList |
|
|
000000B8 |
0008 |
UINT64 - stp |
18446744073709551615 |
|
000000C0 |
0004 |
ULONG - cb |
0x00000000 |
|
000000C4 |
0008 |
UINT64 - cbExpectedFileLength |
0x0000000000003190 |
|
000000CC |
0008 |
UINT64 - cbFreeSpaceInFreeChunkList |
0x0000000000000000 |
|
000000D4 |
0010 |
GUID - guidFileVersion |
{A9E957F9-A065-4E7D-AFB3-96B7311504DF} |
|
000000E4 |
0008 |
UINT64 - nFileVersionGeneration |
15 |
|
000000EC |
0010 |
GUID - guidDenyReadFileVersion |
{A8EE13E0-7E37-46D4-BA83-AB3248782D16} |
|
000000FC |
0004 |
ULONG - grfDebugLogFlags |
0 |
|
00000100 |
000C |
FileChunkReference64x32 - fcrDebugLog |
|
|
00000100 |
0008 |
UINT64 - stp |
0x0000000000000000 |
|
00000108 |
0004 |
ULONG - cb |
0x00000000 |
|
0000010C |
000C |
FileChunkReference64x32 - fcrAllocVerificationFreeChunkList |
|
|
0000010C |
0008 |
UINT64 - stp |
0x0000000000000000 |
|
00000114 |
0004 |
ULONG - cb |
0x00000000 |
|
00000118 |
0004 |
BuildNumber - bnCreated |
0x0FA129B4 |
|
0000011C |
0004 |
BuildNumber - bnLastWroteToThisFile |
0x0FA129B4 |
|
00000120 |
0004 |
BuildNumber - bnOldestWritten |
0x0FA129B4 |
|
00000124 |
0004 |
BuildNumber - bnNewestWritten |
0x0FA129B4 |
|
00000128 |
02D8 |
FixedBlob - rgbReserved |
0 |
guidFileType: "{7B5C52E4-D88C-4DA7-AEB1-5378D02996D3}" specifies that the file format is .one, rather than .onetoc2.
guidFile: This GUID provides a unique identity for each file.
guidFileFormat: {109ADD3F-911B-49F5-A5D0-1791EDC8AED8} identifies this file as a OneNote Revision Store.
ffvLastCodeThatWroteToThisFile: 42 specifies that the file format is from Microsoft OneNote 2010.
ffvOldestCodeThatHasWrittenToThisFile: 42 specifies that the file format is from OneNote 2010.
ffvNewestCodeThatHasWrittenToThisFile: 42 specifies that the file format is from OneNote 2010.
ffvOldestCodeThatMayReadThisFile: 42 specifies that versions of OneNote older than OneNote 2010 cannot read this file.
cTransactionsInLog: 15 specifies that the first 15 entries in the transaction log are complete. Any additional entries are not yet ready and are ignored.
fHasNoEmbeddedFileObjects: Set to 0, even when the file indeed contains no embedded file objects.
guidAncestor: This GUID matches the guidFile field of the .onetoc2 file in the same directory as this .one file.
crcName: 0xCEBE8422 is the CRC that is derived from the section name "Example.one".
fcrHashedChunkList: Specifies that the hashed chunk list is located at offset 0x12a8 in the file, and is 0x400 bytes in length.
fcrTransactionLog: Specifies that the first fragment of the transaction log is located at offset 0x800 in the file, and is 0x400 bytes in length.
fcrFileNodeListRoot: Specifies that the first fragment of the root file node list is located at offset 0x400 in the file, and is 0x400 bytes in length.
fcrFreeChunkList: "fcrNil" specifies that there is no free chunk list in this file.
cbExpectedFileLength: 0x3190 -- matches the byte size of this file.
cbFreeSpaceInFreeChunkList: This field is zero, because the file contains no free chunk list.
guidFileVersion: This is a unique GUID, created when this file was last modified.
nFileVersionGeneration: 15 indicates the number of times this file has been modified. It coincides with cTransactionsInLog, so each modification adds a new log entry, but the two numbers do not need to be in sync.
guidDenyReadFileVersion: This is a unique GUID, created during a recent modification to the file.
bnCreated: 0x0FA129B4 indicates OneNote 2010 build number 14.0.4763.1000.
bnLastWroteToThisFile: 0x0FA129B4 indicates OneNote 2010 build number 14.0.4763.1000.
bnOldestWritten: 0x0FA129B4 indicates OneNote 2010 build number 14.0.4763.1000.
bnNewestWritten: 0x0FA129B4 indicates OneNote 2010 build number 14.0.4763.1000.