Extensible Storage Engine (ESE) Database
| Format | Extensible Storage Engine (ESE) Database |
|---|---|
| Short name | ESE |
| Category | database |
| Platforms | Windows |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Microsoft's embedded database engine (JET Blue). Used by SRUM (SRUDB.dat — per-app network and energy usage), Windows Search up to Windows 10 (Windows.edb; Windows 11 uses SQLite instead), Internet Explorer/Edge legacy WebCache, Active Directory (ntds.dit) and Exchange. Pages are written through transaction logs (.log/.jrs), and a database copied from a live system may be in a 'dirty shutdown' state (recorded in the file header) with changes still only in the logs.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 4 (0x4) | EF CD AB 89 | .... | File header signature 0x89ABCDEF at offset 4 |
Known extensions
.edb, .dat, .dit
References
- Extensible Storage Engine (ESE) Database File (EDB) format (libyal/libesedb) https://github.com/libyal/libesedb/blob/main/documentation/Extensible%20Storage%20Engine%20(ESE)%20Database%20File%20(EDB)%20format.asciidoc
- ForensicsWiki — ESE database file format https://forensics.wiki/extensible_storage_engine_(ese)_database_file_(edb)_format/
- Windows Search Index: the forensic artifact you've been searching for — ESE vs. SQLite in Windows 11 (LevelBlue/Stroz Friedberg, 2023) https://www.levelblue.com/blogs/spiderlabs-blog/windows-search-index-the-forensic-artifact-youve-been-searching-for/
Cite this entry
Crush Format Reference, “Extensible Storage Engine (ESE) Database”. https://kalink0.github.io/crush-forensics/formats/ese/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction