3.3 Root Object Space
In the preceding Root File Node List example, the root object space was identified as gosid set to "{{CFDC64CA-6425-4223-903F-0B7D8A6690F9},1}". Because this is a .one file, the root object space is the data for a Microsoft OneNote 2010 section.
To gather the data for this section, read the object space manifest list for that object space. That indicates the location of the active revision manifest list. The revision manifest list, in turn, indicates a collection of revision manifests, including references to object group lists that contain all the object nodes in the section. Finally, the objects have references to their properties.
The object space manifest list starts with an ObjectSpaceManifestListStartFND file node, which confirms the gosid of the object space. It then contains one or more RevisionManifestListReferenceFND file nodes. If there is more than one, ignore all but the last one. In this example, there is only one.
Offset |
Size |
Structure |
Value |
---|---|---|---|
00000C00 |
0120 |
FileNodeListFragment - FileNodeListFragment |
|
00000C00 |
0010 |
FileNodeListHeader - header |
|
00000C00 |
0008 |
UINT64 - uintMagic |
11841787174971765956 |
00000C08 |
0004 |
ULONG - FileNodeListID |
0x00000011 |
00000C0C |
0004 |
ULONG - nFragmentSequence |
0 |
00000C10 |
0018 |
FileNode - fnd[0] |
|
00000C10 |
0004 |
FileNodeHeader - header |
0x0880600C |
00000C14 |
0014 |
|
|
00000C14 |
0014 |
ExtendedGUID - gosid |
{{CFDC64CA-6425-4223-903F-0B7D8A6690F9},1} |
00000C28 |
0007 |
FileNode - fnd[1] |
|
00000C28 |
0004 |
FileNodeHeader - header |
0x95001C10 |
00000C2C |
0003 |
|
|
00000C2C |
0003 |
FileNodeListReferenceWithIndirection - ref |
|
00000C2C |
0002 |
USHORT - stp |
0x01A4 |
00000C2E |
0001 |
BYTE - cb |
0x24 |
00000C2F |
00F1 |
Blob - padding and footer |
... |
fnd[0].header: 0x0880600C specifies that the FileNode is of type "ObjectSpaceListStartFND", that it contains 20 bytes of data beyond the header, and that it does not contain a reference to another part of the file.
fnd[0].fnd.gosid: {{CFDC64CA-6425-4223-903F-0B7D8A6690F9},1} specifies the identity of the object space. It matches the gosid specified by the ObjectSpaceManifestListReferenceFND that directed it here.
fnd[1].header: 0x95001C10 specifies that the FileNode is of type "RevisionManifestListReferenceFND", that it contains 3 bytes of data beyond the header, that the data begins with a compressed reference to another part of the file, and that a file node list can be found at that other file location.
fnd[1].fnd.ref: Specifies that the first fragment of the revision manifest list is located at offset 0xD20 in the file, and is 0x120 bytes in length.
Following the file offset to the object space’s revision manifest list, there is potentially a long list of FileNodes that create and manage multiple revisions of the object space. Some of the FileNodes might be grouped into sequences that together specify a revision. Other FileNodes might modify or extend an existing revision. In this example, there is just one sequence, which specifies a single revision for the section object space.
Offset |
Size |
Structure |
Value |
---|---|---|---|
00000D20 |
0120 |
FileNodeListFragment - FileNodeListFragment |
|
00000D20 |
0010 |
FileNodeListHeader - header |
|
00000D20 |
0008 |
UINT64 - uintMagic |
11841787174971765956 |
00000D28 |
0004 |
ULONG - FileNodeListID |
0x00000012 |
00000D2C |
0004 |
ULONG - nFragmentSequence |
0 |
00000D30 |
001C |
FileNode - fnd[0] |
|
00000D30 |
0004 |
FileNodeHeader - header |
0x80807014 |
00000D34 |
0018 |
|
|
00000D34 |
0014 |
ExtendedGUID - gosid |
{{CFDC64CA-6425-4223-903F-0B7D8A6690F9},1} |
00000D48 |
0004 |
ULONG - nInstance |
|
00000D4C |
0032 |
FileNode - fnd[1] |
|
00000D4C |
0004 |
FileNodeHeader - header |
0x8080C81E |
00000D50 |
002E |
|
|
00000D50 |
0014 |
ExtendedGUID - rid |
{{082ED24F-9AA5-4DB8-875D-3E1FEE0AD4F4},1} |
00000D64 |
0014 |
ExtendedGUID - ridDependent |
{{00000000-0000-0000-0000-000000000000},0} |
00000D78 |
0004 |
ULONG - RevisionRole |
1 |
00000D7C |
0002 |
USHORT - odcsDefault |
0x0000 |
00000D7E |
001B |
FileNode - fnd[2] |
|
00000D7E |
0004 |
FileNodeHeader - header |
0x95006CB0 |
00000D82 |
0017 |
|
|
00000D82 |
0003 |
FileNodeListReferenceWithIndirection - ref |
|
00000D82 |
0002 |
USHORT - stp |
0x01E9 |
00000D84 |
0001 |
BYTE - cb |
0x24 |
00000D85 |
0014 |
ExtendedGUID - ObjectGroupID |
{{2A83AE62-6754-4383-8E2B-4033FF3CFBA1},1} |
00000D99 |
001C |
FileNode - fnd[3] |
|
00000D99 |
0004 |
FileNodeHeader - header |
0x8080705A |
00000D9D |
0018 |
RootObjectReference3FND - fnd |
|
00000D9D |
0014 |
ExtendedGUID - oidRoot |
{{9A416C35-236A-49A1-91FE-BD73076400A4},11} |
00000DB1 |
0004 |
ULONG - RootRole |
2 |
00000DB5 |
001C |
FileNode - fnd[4] |
|
00000DB5 |
0004 |
FileNodeHeader - header |
0x8080705A |
00000DB9 |
0018 |
RootObjectReference3FND - fnd |
|
00000DB9 |
0014 |
ExtendedGUID - oidRoot |
{{9A416C35-236A-49A1-91FE-BD73076400A4},10} |
00000DCD |
0004 |
ULONG - RootRole |
1 |
00000DD1 |
0004 |
FileNode - fnd[5] |
|
00000DD1 |
0004 |
FileNodeHeader - header |
0x8080101C |
00000DD5 |
006B |
Blob - padding and footer |
... |
fnd[0].header: 0x80807014 specifies that the FileNode is of type "RevisionManifestListStartFND", that it contains 24 bytes of data beyond the header, and that it does not contain a reference to another part of the file.
fnd[0].fnd.gosid: {{CFDC64CA-6425-4223-903F-0B7D8A6690F9},1} specifies yet again the identity of the object space. It matches the gosid specified by the ObjectSpaceManifestListReferenceFND and ObjectSpaceManifestListStartFND that directed it here.
fnd[1].header: 0x8080C81E specifies that the FileNode is of type "RevisionManifestStart6FND", that it contains 46 bytes of data beyond the header, and that it does not contain a reference to another part of the file.
fnd[1].fnd.rid: {{082ED24F-9AA5-4DB8-875D-3E1FEE0AD4F4},1} specifies the identity of the revision formed by this revision manifest.
fnd[1].fnd.ridDependent: "{{00000000-0000-0000-0000-000000000000},0" specifies that there is no dependent revision. All of the objects needed to make a valid object space revision are declared in this FileNode sequence.
fnd[1].fnd.RevisionRole: 1 specifies that the revision created from this manifests labels itself the active content for this object space. It is all right if other revision manifests also specify RevisionRole 1. In that case, the actual active content is the last revision in the revision manifest list which receives that label.
fnd[1].fnd.odcsDefault: 0x0000 specifies that the object properties for objects declared by this revision manifest are not encrypted.
fnd[2].header: 0x95006CB0 specifies that the FileNode is of type "ObjectGroupListReferenceFND", that it contains 23 bytes of data beyond the header, that the data begins with a compressed reference to another part of the file, and that a file node list can be found at that other file location.
fnd[2].fnd.ref: Specifies that the first fragment of the object group list is located at offset 0xF48 in the file, and is 0x120 bytes in length
fnd[2].fnd.ObjectGroupID: {{2A83AE62-6754-4383-8E2B-4033FF3CFBA1},1} specifies the identity of the object group.
fnd[3].header: 0x8080705A specifies that the FileNode is of type "RootObjectReference3FND", that it contains 24 bytes of data beyond the header, and that the data does not contain a reference to another part of the file.
fnd[3].fnd.oidRoot: {{9A416C35-236A-49A1-91FE-BD73076400A4},11} specifies the identity of one of the root objects of this revision. The object might or might not be declared in this revision, because it could be declared in a dependent revision. In this example, the object is declared in the object group list referenced previously.
fnd[3].fnd.RootRole: 2 specifies that the object is the metadata root.
fnd[4].header: 0x8080705A specifies that the FileNode is of type "RootObjectReference3FND", that it contains 24 bytes of data beyond the header, and that the data does not contain a reference to another part of the file.
fnd[4].fnd.oidRoot: {{9A416C35-236A-49A1-91FE-BD73076400A4},10} specifies the identity of another root object for this revision.
fnd[4].fnd.RootRole: 1 specifies that the object is the default content root.
fnd[5].header: 0x8080101C specifies that the FileNode is of type "RevisionManifestEndFND", and that it contains zero bytes of data beyond the header. If there were more FileNodes in the list after this one, they would not be considered part of the revision manifest declared by fnd[1].