EDB

Generated by scripts/gen-format-pages.py from docs/data/format-metadata/, FILE_FORMATS.csv and docs/formats-master.csv. Do not edit by hand: change the source, then run the script.

Extensible Storage Engine Database.

At a glance

How much Poka reads

B4 Summary. The container and metadata are read and summarised (counts, properties, structure), but the main content is not rendered.

Confidence: high (the reviewer read the code and a test that proves the claim). Basis: Reviewed 2026-10-21: read parsers/poka-edb/src/lib.rs in full, its unit tests and tests/samples.rs, corpus sample Catalog1.edb (version 0x620, revision 0x14, 4096-byte pages, dirty shutdown). The header and the catalogue are read: the ten tables, their column and index counts and root pages match esentutl /mm on the same file, and a copy cut in the middle of every page lists no table it did not read. Covers ESE databases with pages up to 8 KiB in the new page-checksum format; the only file tested is one 4 KiB-page database. B4: the structure is summarised, no table content is read.

What Poka does not read

• Rows and record values
• Column names and types, and index keys (only their counts are shown)
• Long-value and callback entries of the catalogue
• Database and attach times
• Database signature and other header fields beyond version, revision, type, state and page size
• Streaming (.stm) file content
• Space trees and page usage
• 16 and 32 KiB pages and the older page-checksum format: the catalogue is reported as not read
• The ECC half of page checksums (the XOR half is checked)
• Log files: a dirty-shutdown database is shown as it is on disk

Background

Wikipedia describes ESE as Microsoft's ISAM storage engine, first released in 1994, at the core of Exchange Server, Active Directory and Windows Search; a database is a single file of fixed-size pages arranged in B-trees. Poka reads the file header (format version and revision, file type, page size and database state; no time field is read), after checking the signature (the second word; the first is a checksum), then walks the catalogue, the MSysObjects B-tree whose root is always page 4, and lists its tables with the number of columns and indexes the catalogue defines for each and the page each table's tree starts at. Each catalogue page's checksum is checked before it is used; a page that is missing or fails is named, and the tables next to it are marked as counted in part. No table rows are read.

Versions

Libraries

Libraries Poka uses or has assessed for this format, with the status, licence and language the registry records.

• ese-core (ese-forensic) (candidate; Apache-2.0; Rust; https://github.com/SecurityRonin/ese-forensic) — Pure Rust ESE reader (no C bindings); uses memmap2, WebAssembly suitability not confirmed; very new project
• libesedb (candidate; LGPL-3.0-or-later; C; https://github.com/libyal/libesedb) — libyal library and tools for ESE databases, with Python bindings (pyesedb); marked experimental
• libesedb (Rust bindings) (candidate; LGPL-3.0-or-later; Rust; https://github.com/sunsetkookaburra/rust-libesedb) — Safe Rust wrapper over the C libesedb, so not pure Rust

Software that uses it

• Computers & Structures ETABS

Sources

• https://en.wikipedia.org/wiki/Extensible_Storage_Engine
• https://github.com/libyal/libesedb/blob/main/documentation/Extensible%20Storage%20Engine%20(ESE)%20Database%20File%20(EDB)%20format.asciidoc
• https://github.com/microsoft/Extensible-Storage-Engine
• parsers/poka-edb/src/lib.rs