Microsoft Access Database (MDB / ACCDB)
| Format | Microsoft Access Database (MDB / ACCDB) |
|---|---|
| Short name | MDB |
| Category | database |
| Platforms | Windows |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
The Jet / ACE database format of Microsoft Access: .mdb (Jet 3 for Access 97, Jet 4 for Access 2000–2003) and .accdb (ACE, Access 2007 and later); the variant 'MSISAM Database' is used by Microsoft Money. Data is stored in pages of 2048 (Jet 3) or 4096 bytes (Jet 4/ACE). The first page names the database engine at offset 4 and holds the format version at offset 0x14; it is obfuscated with a fixed RC4 key and contains the database password (offset 0x42), in Jet 4 additionally masked with a value derived from the database creation date stored on the same page. Deleted rows are only flagged in the row offset table of their data page, so their content can remain until the database is compacted. Such databases are common in business, accounting and administrative applications.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 4 (0x4) | 53 74 61 6E 64 61 72 64 20 4A 65 74 20 44 42 | Standard Jet DB | Engine name 'Standard Jet DB' (Jet 3 / Jet 4, .mdb) |
| offset 4 (0x4) | 53 74 61 6E 64 61 72 64 20 41 43 45 20 44 42 | Standard ACE DB | Engine name 'Standard ACE DB' (Access 2007 and later, .accdb) |
| offset 4 (0x4) | 4D 53 49 53 41 4D 20 44 61 74 61 62 61 73 65 | MSISAM Database | Engine name 'MSISAM Database' (Microsoft Money variant) |
Known extensions
.mdb, .accdb, .mny
References
- MDB file format notes (mdbtools HACKING.md) https://github.com/mdbtools/mdbtools/blob/dev/HACKING.md
Cite this entry
Crush Format Reference, “Microsoft Access Database (MDB / ACCDB)”. https://kalink0.github.io/crush-forensics/formats/mdb/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction