OneNote Revision Store (ONE)
| Format | OneNote Revision Store (ONE) |
|---|---|
| Short name | OneNote |
| Category | document |
| Platforms | Windows, macOS |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
The OneNote revision store format of section files (.one) and table-of-contents files (.onetoc2). The header identifies the file type and format by GUIDs; content is stored as revisions of object spaces, so earlier page versions and removed content can remain in the file. Sections can embed arbitrary files, which has also been used to deliver malware via OneNote attachments.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | E4 52 5C 7B 8C D8 A7 4D AE B1 53 78 D0 29 96 D3 | .R\{...M..Sx.).. | guidFileType {7B5C52E4-D88C-4DA7-AEB1-5378D02996D3} (.one section) |
| offset 0 (0x0) | A1 2F FF 43 D9 EF 76 4C 9E E2 10 EA 57 22 76 5F | ./.C..vL....W"v_ | guidFileType {43FF2FA1-EFD9-4C76-9EE2-10EA5722765F} (.onetoc2) |
| offset 48 (0x30) | 3F DD 9A 10 1B 91 F5 49 A5 D0 17 91 ED C8 AE D8 | ?......I........ | guidFileFormat {109ADD3F-911B-49F5-A5D0-1791EDC8AED8} |
Known extensions
.one, .onetoc2
References
- [MS-ONESTORE]: OneNote Revision Store File Format (Microsoft) https://learn.microsoft.com/en-us/openspecs/office_file_formats/ms-onestore/ae670cd2-4b38-4b24-82d1-87cfb2cc3725
- pyOneNote — header GUIDs (DissectMalware) https://github.com/DissectMalware/pyOneNote/blob/main/pyOneNote/Header.py
Cite this entry
Crush Format Reference, “OneNote Revision Store (ONE)”. https://kalink0.github.io/crush-forensics/formats/onenote/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction