EDB File Structure in HEX

To understand Hexadecimal code exchange EDB file we need to understand its structure first and read edb file in HEX. What does EDB file HEX contain and how to view HEX code of EDB file. EDB file also named as Extensible Storage Engine (ESE) Database file. This file consists of different parts or acts as a single file depends on Exchange version. But all EDB Files contain the same signature if they are healthy and not corrupt. The ESE database Hexadecimal code is complex but at the end of this description, you will able to know HEX view of EDB files.

This article will also give you the description on how to view HEX view of EDB file, view EDB file body HEX code, open EDB file header HEX code, read EDB file location HEX code etc. This article will also give you idea about how to read and study HEX view of EDB file.

 

Different Types of EDB Files HEX View

There are different types of EDB file according to different versions of exchange. These files with their exchange version and default location are mentioned below. You can locate EDB in HEX using this location.

Exchange 2003 and below version: Priv.edb, Pub.edb, name.stm

Once the i.Hex is installed then follow the steps given below.

Exchange 2007 and 2010: Public mailbox.edb and Private mailbox.edb

• For Exchange 2007 Directory:    
• For Exchange 2010 Directory:  

Exchange 2013 and above: Mailbox.edb file

Now, we will see three different types of EDB files HEX view. To learn EDB HEX you need to know types of edb file. These files are priv.edb, pub.edb and mailbox.edb. Mailbox.edb is formed in recent versions while priv.edb and pub.edb were formed in Exchange 2003 and earlier versions. Their HEX view can be shown as follows.

HEX View of Priv.edb(2003 and below versions)

The Hexadecimal code of Priv.edb is shown as below. As you can see the file signature of EDB file is EF CD AB 89 in priv.edb HEX view.

HEX View of Pub.edb (2003 and below versions)

The Hexadecimal code of Pub.edb is shown below. Although the file signature will remain same in a pub.edb HEX view.

HEX View of Mailbox .edb(2007 and above versions)

In 2007 and above version the file structure will remain same. Although the characters for database clean state will change as shown below. For each mailbox.edb file this clean state will change in the mailbox.edb HEX view.

As you can see HEX View of EDB File, In all files signature of file i.e. EF CD AB 89 remain same in the header section(first line of Hexadecimal code). Since the ASCII characters of this EDB file is unknown to HEX editor, It shows a (...) symbol in place of characters in the third column.

 

Steps to HEX View EDB Files

To view EDB file HEX view you need to Import and HEX read EDB file from Exchange database. Remember which version of Exchange you are using. Since all exchange versions have different directory structure, Hence you will file files at a different location in each version. All location of EDB file has been mentioned above. To view EDB file in HEX follow the steps given below:

• Open HEX editor to view EDB Files.
  
  
  
  
• Now, Click Open to Open EDB file HEX view
  
  
  
  
• Or Click File > Open to see EDB File HEX view
  
  
  
  

 

Brief of EDB file HEX Code

EDB file is one of the largest database files is an exchange. This file consists of several encryption and data. EDB files follow B-tree structure. This structure allows user to perform structured queries indirectly to exchange database. Also, Exchnage provides various other tools like ESEUTIL or ISINTEG command line to perform functions on exchange EDB files. We will discuss later how you can use these commands to recover and view EDB Files after HEX editing.

The database in EDB files consists of Tables. These tables are made up of several features like:

• Rows
• Columns

EDB structures in HEX also consist of metatables. These tables are required to maintain the database. Some of the meta tables are:

1. The space Tree
2. The catalog and backup catalog

The header of an EDB file consist of various offset and has a size of minimum 668 bytes.

 

Verify and differentiate healthy EDB file from corrupt

All healthy EDB files consist of their signature. Hence, If you want to know whether your EDB file is healthy or not, then you can use HEX editor to View EDB Hexadecimal signature. Apart from view HEX code of EDB file, it allows user to open and edit EDB files. But you must take a backup before performing any operation on EDB File. Since EDB File consists of all mail data, therefore you must not perform these functions directly on EDB files if you are a beginner or doesn't know HEX code of EDB file.

As Mentioned below there are three different EDB files. All files have the same signature. Also, there is a corrupt EDB file.

• Priv.edb file HEX view: This file exists in exchange 2003 and exchange 2002. The header of this file is shown below:    
• Pub.edb file HEX view:This file also exists in exchange 2003 and earlier versions. The header section of this file can be seen as follows:  
   
• Mailbox.edb file HEX view: This file exists in Exchange 2007 and above versions. The header section of this file is shown below:  

 

Conclusion

This information given above is based on how you can view HEX view of EDB files. The Hexadecimal code is complex, hence to view this code user need to know HEX basics of EDB file. The EDB file format HEX view is the best view to understanding the structure and configuration of EDB file. So if you want to know the HEX basics and view HEX code of EDB file then you may refer article above to understand its basics. We will learn about the basic difference in corrupt HEX view of EDB file and edit EDB file in HEX in next section.

---