How to read Datastore.edb

Discussion in 'Windows 10' started by atplsx, Mar 1, 2016.

  1. atplsx

    atplsx MDL Member

    May 11, 2009
    113
    80
    10
    How to read Datastore.edb without Nirsoft ESEDatabaseView
    other software or script any idea
     
  2. endbase

    endbase MDL Guru

    Aug 12, 2012
    3,423
    867
    120
    Microsoft Access could do the trick possibly :tea:
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. atplsx

    atplsx MDL Member

    May 11, 2009
    113
    80
    10
    #3 atplsx, Mar 1, 2016
    Last edited: Mar 1, 2016
    (OP)
    thanks i try,
    No working
     
  4. pisthai

    pisthai Imperfect Human

    Jul 29, 2009
    6,638
    1,921
    210
    Find out the origin DB source with using a HEX Editor and than use the related Viewer for to access that file.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  5. abbodi1406

    abbodi1406 MDL KB0000001

    Feb 19, 2011
    7,156
    21,908
    240
    #5 abbodi1406, Mar 1, 2016
    Last edited by a moderator: Apr 20, 2017
    Code:
    esentutl.exe /?
    File Dump option
     
  6. atplsx

    atplsx MDL Member

    May 11, 2009
    113
    80
    10
    how to export csv all table readable format
    give me example
     
  7. abbodi1406

    abbodi1406 MDL KB0000001

    Feb 19, 2011
    7,156
    21,908
    240
    #7 abbodi1406, Mar 1, 2016
    Last edited by a moderator: Apr 20, 2017
    If it was that easy we wouldn't need ESEDatabaseView :rolleyes:
    i never used it, it seems complicated :mushy:

    Code:
    FILE DUMP:
        DESCRIPTION:  Generates formatted output of various database file types.
             SYNTAX:   /m[mode-modifier] <filename> [options]
         PARAMETERS:  [mode-modifier] - an optional letter designating the type of
                                        file dump to perform. Valid values are:
                                        h - dump database header (default)
                                        k - dump checkpoint file
                                        l - dump log file or set of logs
                                        m - dump meta-data
                                        s - dump space usage
                      <filename>      - name of file to dump. The type of the
                                        specified file should match the dump type
                                        being requested (eg. if using /mh, then
                                        <filename> must be the name of a database).
            OPTIONS:  zero or more of the following switches, separated by a space:
                      /p<pgno>   - dump the specified page from the database
                      /t<table>  - perform dump for specified table only
                      /v         - verbose
                      /2         - set 2k database page size (default: auto-detect)
                      /4         - set 4k database page size (default: auto-detect)
                      /8         - set 8k database page size (default: auto-detect)
                      /16        - set 16k database page size (default: auto-detect)
                      /32        - set 32k database page size (default: auto-detect)
                      /o         - suppress logo
                      /c<file>   - for dump of a single log file only, dump the
                                   log file, in CSV format, to <file>
                      /x         - for dump of a single log file only, permits
                                   fixup of torn writes at the end of the log file
                                   if necessary (NOTE: requires read/write access
                                   to the log file)
    
                      SPACE USAGE OPTIONS:
    
                      /f<field[,field]>
                                 - Space info fields to print.
                                   Sets of fields:
                                      /f#spacehints - Prints the spacehint settings
                                                      for the object.
                                      /f#default    - Produces default output.
                                      /f#legacy     - Print out the legacy set of
                                                      fields.
                                      /f#all        - Print out all fields for
                                                      which we collect stats.
                                   Independent fields:
                                      Name, FullName, Type, ObjidFDP, PgnoFDP, PriExt, 
                                      Owned(MB), %OfDb, %OfTable, Available, Avail(MB), 
                                      AutoInc, Reserved, Reser(MB), Reser%Tbl, Empty, 
                                      Internal(MB), Data, Data(MB), Depth, IORuns, 
                                      FwdScans, Int:FreeBytes, Int:Nodes, Int:KeySizes, 
                                      Data:FreeBytes, Data:Nodes, Data:KeySizes, 
                                      Data:KeyComp, Data:Unreclaim, VersndNode, cLVs, 
                                      cLVChunks, cCorrLVs, cSepRtChk, lidMax, 
                                      SH:ISize(KB), SH:grbit, SH:MDensity, SH:Growth, 
                                      SH:MaxExt(KB)                  /csv       - Print all fields CSV delimited.
    
     
  8. atplsx

    atplsx MDL Member

    May 11, 2009
    113
    80
    10
    please give me example
    i tried
    esentutl.exe /mh DataStore.edb /t /c1
    take error
     
  9. xinso

    xinso MDL Guru

    Mar 5, 2009
    3,399
    4,928
    120
    #9 xinso, Mar 1, 2016
    Last edited: Mar 1, 2016
    What can we do with Nirsoft ESEDatabaseView? Thanks.
     
  10. atplsx

    atplsx MDL Member

    May 11, 2009
    113
    80
    10
    #10 atplsx, Mar 2, 2016
    Last edited: Mar 2, 2016
    (OP)
    yes you can.
    But file name, sha algoritm show uppercase letter and spaced.
     
  11. xinso

    xinso MDL Guru

    Mar 5, 2009
    3,399
    4,928
    120
  12. xinso

    xinso MDL Guru

    Mar 5, 2009
    3,399
    4,928
    120
    #14 xinso, Mar 3, 2016
    Last edited: Mar 3, 2016
    Thank you. But the screenshots are so small that I can not read it.

    Edit: Never mind. I can do it manually by NotePad. Thank you all.

    14276? A new build to come these days?
     
  13. xinso

    xinso MDL Guru

    Mar 5, 2009
    3,399
    4,928
    120
    #15 xinso, Mar 3, 2016
    Last edited by a moderator: Apr 20, 2017
    Path

    Code:
    esentutl /mh I:\Windows\SoftwareDistribution\DataStore\DataStore.edb
    Code:
    C:\windows\system32>esentutl /mh I:\Windows\SoftwareDistribution\DataStore\DataStore.edb
    
    Extensible Storage Engine Utilities for Microsoft(R) Windows(R)
    Version 10.0
    Copyright (C) Microsoft Corporation. All Rights Reserved.
    
    Initiating FILE DUMP mode...
             Database: I:\Windows\SoftwareDistribution\DataStore\DataStore.edb
    
    
    DATABASE HEADER:
    Checksum Information:
    Expected Checksum: 0x357ce875
      Actual Checksum: 0x357ce875
    
    Fields:
            File Type: Database
             Checksum: 0x357ce875
       Format ulMagic: 0x89abcdef
       Engine ulMagic: 0x89abcdef
     Format ulVersion: 0x620,20
     Engine ulVersion: 0x620,20
    Created ulVersion: 0x620,20
         DB Signature: Create time:03/01/2016 23:07:35.679 Rand:736120915 Computer:
             cbDbPage: 16384
               dbtime: 170665 (0x29aa9)
                State: Clean Shutdown
         Log Required: 0-0 (0x0-0x0)
        Log Committed: 0-0 (0x0-0x0)
       Log Recovering: 0 (0x0)
       Log Consistent: 0 (0x0)
      GenMax Creation: 00/00/1900 00:00:00.000
             Shadowed: Yes
           Last Objid: 66
         Scrub Dbtime: 0 (0x0)
           Scrub Date: 00/00/1900 00:00:00
         Repair Count: 0
          Repair Date: 00/00/1900 00:00:00.000
     Old Repair Count: 0
      Last Consistent: (0x62,B,64)  03/02/2016 16:55:58.755
          Last Attach: (0x62,9,268)  03/02/2016 16:55:58.099
          Last Detach: (0x62,B,64)  03/02/2016 16:55:58.755
        Last ReAttach: (0x0,0,0)  00/00/1900 00:00:00.000
                 Dbid: 1
        Log Signature: Create time:03/01/2016 23:07:34.882 Rand:1863799758 Computer:
           OS Version: (10.0.10586 SP 0 NLS ffffffff.ffffffff)
    
    Previous Full Backup:
            Log Gen: 0-0 (0x0-0x0)
               Mark: (0x0,0,0)
               Mark: 00/00/1900 00:00:00.000
    
    Previous Incremental Backup:
            Log Gen: 0-0 (0x0-0x0)
               Mark: (0x0,0,0)
               Mark: 00/00/1900 00:00:00.000
    
    Previous Copy Backup:
            Log Gen: 0-0 (0x0-0x0)
               Mark: (0x0,0,0)
               Mark: 00/00/1900 00:00:00.000
    
    Previous Differential Backup:
            Log Gen: 0-0 (0x0-0x0)
               Mark: (0x0,0,0)
               Mark: 00/00/1900 00:00:00.000
    
    Current Full Backup:
            Log Gen: 0-0 (0x0-0x0)
               Mark: (0x0,0,0)
               Mark: 00/00/1900 00:00:00.000
    
    Current Shadow copy backup:
            Log Gen: 0-0 (0x0-0x0)
               Mark: (0x0,0,0)
               Mark: 00/00/1900 00:00:00.000
    
         cpgUpgrade55Format: 0
        cpgUpgradeFreePages: 0
    cpgUpgradeSpaceMapPages: 0
    
           ECC Fix Success Count: none
       Old ECC Fix Success Count: none
             ECC Fix Error Count: none
         Old ECC Fix Error Count: none
        Bad Checksum Error Count: none
    Old bad Checksum Error Count: none
    
      Last checksum finish Date: 00/00/1900 00:00:00.000
    Current checksum start Date: 00/00/1900 00:00:00.000
          Current checksum page: 0
    
      Database Header Flush Signature: Create time:03/02/2016 16:55:58.755 Rand:470424154 Computer:
     Flush Map Header Flush Signature: Create time:00/00/1900 00:00:00.000 Rand:0 Computer:
    
    
    Operation completed successfully in 0.250 seconds.
    
    
    C:\windows\system32>
    
    
    No way to dump download link... Too hard for me. Quit.
     
  14. atplsx

    atplsx MDL Member

    May 11, 2009
    113
    80
    10
    #16 atplsx, Mar 3, 2016
    Last edited by a moderator: Apr 20, 2017
    (OP)
    yes too hard. many command try but i cant dump
     
  15. xinso

    xinso MDL Guru

    Mar 5, 2009
    3,399
    4,928
    120
  16. xinso

    xinso MDL Guru

    Mar 5, 2009
    3,399
    4,928
    120
    #19 xinso, Mar 3, 2016
    Last edited: Mar 3, 2016
    No. It is of no good at all. I would rather stick with DataStore.edb + Notepad + findstr /i http.

    Thank you, atplsx.
     
  17. atplsx

    atplsx MDL Member

    May 11, 2009
    113
    80
    10
    hmm. your choice