Glossary
esentutl
Built-in Windows command-line utility for ESE databases: header dump, soft recovery from logs, integrity check, repair, compaction and shadow-copy copy.
esentutl.exe ships with Windows and works on any ESE database, including Windows.edb. The modes that matter in forensics: /mh dumps the header (state, page size, required logs), /r performs soft recovery from the transaction logs, /y copies a file, with /vss or /vssrec to read an in-use database through a shadow copy.
Other modes change data: /p repairs by discarding what it cannot fix, /d compacts and reclaims free space where deleted records could be carved. Use them only on copies. Microsoft keeps an archived reference. Walk-through: Windows.edb dirty shutdown.