Crate ese_parser 

ese-parser — Microsoft Extensible Storage Engine (ESE / “Jet Blue”) file parser in pure Rust.

ESE is the on-disk B-tree database Windows uses for anything that needs local persistence with recovery: ntds.dit (Active Directory), WebCacheV*.dat (Edge/IE history), Windows.edb (Search index), Mail.dat (legacy Exchange), event-tracing logs.

This crate is a from-scratch parser (no C-lib FFI) focused on read-only forensic / offensive-security use — the subset a defender or attacker needs to extract data from a captured .dit/.edb, not the full writable Jet API.

v0.1 scope

• EseFile::open — parse the 668-byte database header (magic, format-version, page-size, file-type, previous-full-backup / previous-incremental-backup metadata, the min/max log-generation numbers required to know if the DB is consistent).
• EseFile::page — random-access read of a specific page by page number, returning a RawPage with parsed header fields (page number, previous/next page in the B-tree sibling chain, page flags telling you whether it’s a leaf/branch/root/parent-of-leaf).
• RawPage constants — page_flag bits, [tag] flag bits.

v0.2 roadmap

• B-tree walk (root → branch → leaf, following child page pointers).
• Catalog table decode — the metadata table that lists every user table + its column definitions.
• Row / tag decode with long-value + multi-value reassembly.
• Then: this becomes the backend for ntds-parse EseBackend trait so callers can for row in ntds.datatable().

Non-goals

• Writable Jet API (this is read-only).
• Recovery from a dirty shutdown (defer that to Windows’ own esentutl /p).
• Encrypted databases (Windows database encryption uses per-page XOR with a table key — out of scope for v0.1).

Verification

Header offsets validated against libesedb’s spec doc. Page header layout matches Joachim Metz’s reverse-engineering notes.

Modules

file_type

File-type values in the database header (offset 12).

page_flag

Page-header flag bits ([MS-ESE] and libesedb reference).

Structs

EseFile

A minimally-parsed ESE database file — reads the header + gives you random-access page reads. Does not walk B-trees or enumerate tables (v0.2 roadmap).

HeaderFields

Result of parsing the 668-byte header without holding onto the file. Callers use this when they want to display + validate header metadata without keeping an open handle.

RawPage

One page read out of the ESE database. Header parsed; page-body bytes retained so downstream (a future B-tree walker) can decode tags on demand.

Enums

Error

Errors this crate returns.

Constants

ESE_FILE_SIGNATURE

The 4-byte little-endian file signature every ESE database starts with (offset 4).