How to read Datastore.edb

Microsoft Access could do the trick possibly

 

Find out the origin DB source with using a HEX Editor and than use the related Viewer for to access that file.

 

Code:

esentutl.exe /?

File Dump option

 

If it was that easy we wouldn't need ESEDatabaseView
i never used it, it seems complicated

Code:

FILE DUMP:
    DESCRIPTION:  Generates formatted output of various database file types.
         SYNTAX:   /m[mode-modifier] <filename> [options]
     PARAMETERS:  [mode-modifier] - an optional letter designating the type of
                                    file dump to perform. Valid values are:
                                    h - dump database header (default)
                                    k - dump checkpoint file
                                    l - dump log file or set of logs
                                    m - dump meta-data
                                    s - dump space usage
                  <filename>      - name of file to dump. The type of the
                                    specified file should match the dump type
                                    being requested (eg. if using /mh, then
                                    <filename> must be the name of a database).
        OPTIONS:  zero or more of the following switches, separated by a space:
                  /p<pgno>   - dump the specified page from the database
                  /t<table>  - perform dump for specified table only
                  /v         - verbose
                  /2         - set 2k database page size (default: auto-detect)
                  /4         - set 4k database page size (default: auto-detect)
                  /8         - set 8k database page size (default: auto-detect)
                  /16        - set 16k database page size (default: auto-detect)
                  /32        - set 32k database page size (default: auto-detect)
                  /o         - suppress logo
                  /c<file>   - for dump of a single log file only, dump the
                               log file, in CSV format, to <file>
                  /x         - for dump of a single log file only, permits
                               fixup of torn writes at the end of the log file
                               if necessary (NOTE: requires read/write access
                               to the log file)

                  SPACE USAGE OPTIONS:

                  /f<field[,field]>
                             - Space info fields to print.
                               Sets of fields:
                                  /f#spacehints - Prints the spacehint settings
                                                  for the object.
                                  /f#default    - Produces default output.
                                  /f#legacy     - Print out the legacy set of
                                                  fields.
                                  /f#all        - Print out all fields for
                                                  which we collect stats.
                               Independent fields:
                                  Name, FullName, Type, ObjidFDP, PgnoFDP, PriExt, 
                                  Owned(MB), %OfDb, %OfTable, Available, Avail(MB), 
                                  AutoInc, Reserved, Reser(MB), Reser%Tbl, Empty, 
                                  Internal(MB), Data, Data(MB), Depth, IORuns, 
                                  FwdScans, Int:FreeBytes, Int:Nodes, Int:KeySizes, 
                                  Data:FreeBytes, Data:Nodes, Data:KeySizes, 
                                  Data:KeyComp, Data:Unreclaim, VersndNode, cLVs, 
                                  cLVChunks, cCorrLVs, cSepRtChk, lidMax, 
                                  SH:ISize(KB), SH:grbit, SH:MDensity, SH:Growth, 
                                  SH:MaxExt(KB)                  /csv       - Print all fields CSV delimited.

 

What can we do with Nirsoft ESEDatabaseView? Thanks.

 

You need to login to view this posts content.

 

You need to login to view this posts content.

 

Thank you. But the screenshots are so small that I can not read it.

Edit: Never mind. I can do it manually by NotePad. Thank you all.

14276? A new build to come these days?

 

Path

Code:

esentutl /mh I:\Windows\SoftwareDistribution\DataStore\DataStore.edb

Code:

C:\windows\system32>esentutl /mh I:\Windows\SoftwareDistribution\DataStore\DataStore.edb

Extensible Storage Engine Utilities for Microsoft(R) Windows(R)
Version 10.0
Copyright (C) Microsoft Corporation. All Rights Reserved.

Initiating FILE DUMP mode...
         Database: I:\Windows\SoftwareDistribution\DataStore\DataStore.edb


DATABASE HEADER:
Checksum Information:
Expected Checksum: 0x357ce875
  Actual Checksum: 0x357ce875

Fields:
        File Type: Database
         Checksum: 0x357ce875
   Format ulMagic: 0x89abcdef
   Engine ulMagic: 0x89abcdef
 Format ulVersion: 0x620,20
 Engine ulVersion: 0x620,20
Created ulVersion: 0x620,20
     DB Signature: Create time:03/01/2016 23:07:35.679 Rand:736120915 Computer:
         cbDbPage: 16384
           dbtime: 170665 (0x29aa9)
            State: Clean Shutdown
     Log Required: 0-0 (0x0-0x0)
    Log Committed: 0-0 (0x0-0x0)
   Log Recovering: 0 (0x0)
   Log Consistent: 0 (0x0)
  GenMax Creation: 00/00/1900 00:00:00.000
         Shadowed: Yes
       Last Objid: 66
     Scrub Dbtime: 0 (0x0)
       Scrub Date: 00/00/1900 00:00:00
     Repair Count: 0
      Repair Date: 00/00/1900 00:00:00.000
 Old Repair Count: 0
  Last Consistent: (0x62,B,64)  03/02/2016 16:55:58.755
      Last Attach: (0x62,9,268)  03/02/2016 16:55:58.099
      Last Detach: (0x62,B,64)  03/02/2016 16:55:58.755
    Last ReAttach: (0x0,0,0)  00/00/1900 00:00:00.000
             Dbid: 1
    Log Signature: Create time:03/01/2016 23:07:34.882 Rand:1863799758 Computer:
       OS Version: (10.0.10586 SP 0 NLS ffffffff.ffffffff)

Previous Full Backup:
        Log Gen: 0-0 (0x0-0x0)
           Mark: (0x0,0,0)
           Mark: 00/00/1900 00:00:00.000

Previous Incremental Backup:
        Log Gen: 0-0 (0x0-0x0)
           Mark: (0x0,0,0)
           Mark: 00/00/1900 00:00:00.000

Previous Copy Backup:
        Log Gen: 0-0 (0x0-0x0)
           Mark: (0x0,0,0)
           Mark: 00/00/1900 00:00:00.000

Previous Differential Backup:
        Log Gen: 0-0 (0x0-0x0)
           Mark: (0x0,0,0)
           Mark: 00/00/1900 00:00:00.000

Current Full Backup:
        Log Gen: 0-0 (0x0-0x0)
           Mark: (0x0,0,0)
           Mark: 00/00/1900 00:00:00.000

Current Shadow copy backup:
        Log Gen: 0-0 (0x0-0x0)
           Mark: (0x0,0,0)
           Mark: 00/00/1900 00:00:00.000

     cpgUpgrade55Format: 0
    cpgUpgradeFreePages: 0
cpgUpgradeSpaceMapPages: 0

       ECC Fix Success Count: none
   Old ECC Fix Success Count: none
         ECC Fix Error Count: none
     Old ECC Fix Error Count: none
    Bad Checksum Error Count: none
Old bad Checksum Error Count: none

  Last checksum finish Date: 00/00/1900 00:00:00.000
Current checksum start Date: 00/00/1900 00:00:00.000
      Current checksum page: 0

  Database Header Flush Signature: Create time:03/02/2016 16:55:58.755 Rand:470424154 Computer:
 Flush Map Header Flush Signature: Create time:00/00/1900 00:00:00.000 Rand:0 Computer:


Operation completed successfully in 0.250 seconds.


C:\windows\system32>

No way to dump download link... Too hard for me. Quit.

 

You need to login to view this posts content.

 

No. It is of no good at all. I would rather stick with DataStore.edb + Notepad + findstr /i http.

Thank you, atplsx.