3.3 Root Object Space

In the preceding Root File Node List example, the root object space was identified as gosid set to "{{CFDC64CA-6425-4223-903F-0B7D8A6690F9},1}". Because this is a .one file, the root object space is the data for a Microsoft OneNote 2010 section.

To gather the data for this section, read the object space manifest list for that object space. That indicates the location of the active revision manifest list. The revision manifest list, in turn, indicates a collection of revision manifests, including references to object group lists that contain all the object nodes in the section. Finally, the objects have references to their properties.

The object space manifest list starts with an ObjectSpaceManifestListStartFND file node, which confirms the gosid of the object space. It then contains one or more RevisionManifestListReferenceFND file nodes. If there is more than one, ignore all but the last one. In this example, there is only one.

Offset

Size

Structure

Value

00000C00

0120

FileNodeListFragment - FileNodeListFragment

00000C00

0010

    FileNodeListHeader - header

00000C00

0008

        UINT64 - uintMagic

11841787174971765956

00000C08

0004

        ULONG - FileNodeListID

0x00000011

00000C0C

0004

        ULONG - nFragmentSequence

0

00000C10

0018

    FileNode - fnd[0]

00000C10

0004

        FileNodeHeader - header

0x0880600C

00000C14

0014

        ObjectSpaceManifestListStartFND - fnd

00000C14

0014

            ExtendedGUID - gosid

{{CFDC64CA-6425-4223-903F-0B7D8A6690F9},1}

00000C28

0007

    FileNode - fnd[1]

00000C28

0004

        FileNodeHeader - header

0x95001C10

00000C2C

0003

        RevisionManifestListReferenceFND - fnd

00000C2C

0003

            FileNodeListReferenceWithIndirection - ref

00000C2C

0002

                USHORT - stp

0x01A4

00000C2E

0001

                BYTE - cb

0x24

00000C2F

00F1

    Blob - padding and footer

...

fnd[0].header: 0x0880600C specifies that the FileNode is of type "ObjectSpaceListStartFND", that it contains 20 bytes of data beyond the header, and that it does not contain a reference to another part of the file.

fnd[0].fnd.gosid: {{CFDC64CA-6425-4223-903F-0B7D8A6690F9},1} specifies the identity of the object space. It matches the gosid specified by the ObjectSpaceManifestListReferenceFND that directed it here.

fnd[1].header: 0x95001C10 specifies that the FileNode is of type "RevisionManifestListReferenceFND", that it contains 3 bytes of data beyond the header, that the data begins with a compressed reference to another part of the file, and that a file node list can be found at that other file location.

fnd[1].fnd.ref:  Specifies that the first fragment of the revision manifest list is located at offset 0xD20 in the file, and is 0x120 bytes in length.

Following the file offset to the object space’s revision manifest list, there is potentially a long list of FileNodes that create and manage multiple revisions of the object space. Some of the FileNodes might be grouped into sequences that together specify a revision. Other FileNodes might modify or extend an existing revision. In this example, there is just one sequence, which specifies a single revision for the section object space.

Offset

Size

Structure

Value

00000D20

0120

FileNodeListFragment - FileNodeListFragment

00000D20

0010

    FileNodeListHeader - header

00000D20

0008

        UINT64 - uintMagic

11841787174971765956

00000D28

0004

        ULONG - FileNodeListID

0x00000012

00000D2C

0004

        ULONG - nFragmentSequence

0

00000D30

001C

    FileNode - fnd[0]

00000D30

0004

        FileNodeHeader - header

0x80807014

00000D34

0018

        RevisionManifestListStartFND - fnd

00000D34

0014

            ExtendedGUID - gosid

{{CFDC64CA-6425-4223-903F-0B7D8A6690F9},1}

00000D48

0004

            ULONG - nInstance

00000D4C

0032

    FileNode - fnd[1]

00000D4C

0004

        FileNodeHeader - header

0x8080C81E

00000D50

002E

        RevisionManifestStart6FND - fnd

00000D50

0014

            ExtendedGUID - rid

{{082ED24F-9AA5-4DB8-875D-3E1FEE0AD4F4},1}

00000D64

0014

            ExtendedGUID - ridDependent

{{00000000-0000-0000-0000-000000000000},0}

00000D78

0004

            ULONG - RevisionRole

1

00000D7C

0002

            USHORT - odcsDefault

0x0000

00000D7E

001B

    FileNode - fnd[2]

00000D7E

0004

        FileNodeHeader - header

0x95006CB0

00000D82

0017

        ObjectGroupListReferenceFND - fnd

00000D82

0003

            FileNodeListReferenceWithIndirection - ref

00000D82

0002

                USHORT - stp

0x01E9

00000D84

0001

                BYTE - cb

0x24

00000D85

0014

            ExtendedGUID - ObjectGroupID

{{2A83AE62-6754-4383-8E2B-4033FF3CFBA1},1}

00000D99

001C

    FileNode - fnd[3]

00000D99

0004

        FileNodeHeader - header

0x8080705A

00000D9D

0018

        RootObjectReference3FND - fnd

00000D9D

0014

            ExtendedGUID - oidRoot

{{9A416C35-236A-49A1-91FE-BD73076400A4},11}

00000DB1

0004

            ULONG - RootRole

2

00000DB5

001C

    FileNode - fnd[4]

00000DB5

0004

        FileNodeHeader - header

0x8080705A

00000DB9

0018

        RootObjectReference3FND - fnd

00000DB9

0014

            ExtendedGUID - oidRoot

{{9A416C35-236A-49A1-91FE-BD73076400A4},10}

00000DCD

0004

            ULONG - RootRole

1

00000DD1

0004

    FileNode - fnd[5]

00000DD1

0004

        FileNodeHeader - header

0x8080101C

00000DD5

006B

    Blob - padding and footer

...

fnd[0].header: 0x80807014 specifies that the FileNode is of type "RevisionManifestListStartFND", that it contains 24 bytes of data beyond the header, and that it does not contain a reference to another part of the file.

fnd[0].fnd.gosid: {{CFDC64CA-6425-4223-903F-0B7D8A6690F9},1} specifies yet again the identity of the object space. It matches the gosid specified by the ObjectSpaceManifestListReferenceFND and ObjectSpaceManifestListStartFND that directed it here.

fnd[1].header: 0x8080C81E specifies that the FileNode is of type "RevisionManifestStart6FND", that it contains 46 bytes of data beyond the header, and that it does not contain a reference to another part of the file.

fnd[1].fnd.rid: {{082ED24F-9AA5-4DB8-875D-3E1FEE0AD4F4},1} specifies the identity of the revision formed by this revision manifest.

fnd[1].fnd.ridDependent: "{{00000000-0000-0000-0000-000000000000},0" specifies that there is no dependent revision. All of the objects needed to make a valid object space revision are declared in this FileNode sequence.

fnd[1].fnd.RevisionRole: 1 specifies that the revision created from this manifests labels itself the active content for this object space. It is all right if other revision manifests also specify RevisionRole 1. In that case, the actual active content is the last revision in the revision manifest list which receives that label.

fnd[1].fnd.odcsDefault: 0x0000 specifies that the object properties for objects declared by this revision manifest are not encrypted.

fnd[2].header: 0x95006CB0 specifies that the FileNode is of type "ObjectGroupListReferenceFND", that it contains 23 bytes of data beyond the header, that the data begins with a compressed reference to another part of the file, and that a file node list can be found at that other file location.

fnd[2].fnd.ref: Specifies that the first fragment of the object group list is located at offset 0xF48 in the file, and is 0x120 bytes in length

fnd[2].fnd.ObjectGroupID: {{2A83AE62-6754-4383-8E2B-4033FF3CFBA1},1} specifies the identity of the object group.

fnd[3].header: 0x8080705A specifies that the FileNode is of type "RootObjectReference3FND", that it contains 24 bytes of data beyond the header, and that the data does not contain a reference to another part of the file.

fnd[3].fnd.oidRoot: {{9A416C35-236A-49A1-91FE-BD73076400A4},11} specifies the identity of one of the root objects of this revision. The object might or might not be declared in this revision, because it could be declared in a dependent revision. In this example, the object is declared in the object group list referenced previously.

fnd[3].fnd.RootRole: 2 specifies that the object is the metadata root.

fnd[4].header: 0x8080705A specifies that the FileNode is of type "RootObjectReference3FND", that it contains 24 bytes of data beyond the header, and that the data does not contain a reference to another part of the file.

fnd[4].fnd.oidRoot: {{9A416C35-236A-49A1-91FE-BD73076400A4},10} specifies the identity of another root object for this revision.

fnd[4].fnd.RootRole: 1 specifies that the object is the default content root.

fnd[5].header: 0x8080101C specifies that the FileNode is of type "RevisionManifestEndFND", and that it contains zero bytes of data beyond the header. If there were more FileNodes in the list after this one, they would not be considered part of the revision manifest declared by fnd[1].