WMI Repository (CIM)
| Format | WMI Repository (CIM) |
|---|---|
| Short name | WMI repository |
| Category | database |
| Platforms | Windows |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
The Common Information Model repository of Windows Management Instrumentation in %SystemRoot%\System32\wbem\Repository\ (Windows Vista and later): INDEX.BTR (index B-tree), OBJECTS.DATA (object records) and MAPPING1–3.MAP (mapping of logical to physical pages), with 8192-byte pages. The repository stores class definitions and instances, including event filters, consumers and bindings used for WMI-based persistence. Unreferenced pages in OBJECTS.DATA can retain deleted objects. Mapping files start with the signature 0x0000ABCD.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | CD AB 00 00 | .... | Mapping file header signature 0x0000ABCD (MAPPING*.MAP) |
Known extensions
None recorded
References
- WMI repository file format (libyal/dtformats) https://github.com/libyal/dtformats/blob/main/documentation/WMI%20repository%20file%20format.asciidoc
Cite this entry
Crush Format Reference, “WMI Repository (CIM)”. https://kalink0.github.io/crush-forensics/formats/wmi-repository/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction