Skip to content

Glossary

Extensible Storage Engine (ESE)

Microsoft's embedded transactional database engine, also called JET Blue, used by Windows.edb, SRUDB.dat, WebCacheV01.dat, Active Directory and Exchange.

The Extensible Storage Engine, formerly known as JET Blue, is an embedded ISAM database engine built into Windows. Microsoft describes it as supporting wide tables with sparse and multi-valued columns, transactions and crash recovery through a write-ahead log.

For forensicators, an ESE file is a header, fixed-size pages organised in B+-trees, a catalog (MSysObjects), and records made of fixed, variable and tagged columns, with separate long values and optional compression. The Windows Search index on Windows 10 (Windows.edb) is an ESE database. Primer: ESE database basics for forensicators.