MS-PST: What is the relationship between nodes, subnodes, and blocks?

StackOverflow https://stackoverflow.com/questions/22180956

Domanda

I am having problems understanding some of the Microsoft PST file format specification.

My understanding:

In the NDB layer, our entry is a NID. Given a NID, we can find the leaf node in the BTree. From there, we have bidData and bidSub.

bidData either points to an external data node, or a data tree.

bidSub points to a subnode tree.

My questions:

  1. Can we have a subnode tree without a data tree?
  2. What circumstances would we have a subnode tree?
  3. Is the result of the subnode tree to be concatenated with the result of the data tree?
È stato utile?

Soluzione

You have 5 questions.

  1. What is the relationship between nodes, subnodes, and blocks?
  2. Can we have a subnode tree without a data tree?
  3. What circumstances would we have a subnode tree?
  4. Is the result of the subnode tree to be concatenated with the result of the data tree?
  5. Should I iterate through the data blocks/tree first, then the subnode tree, or is there some other way to organize the data I read ?

The answer to question 1 per the standard located here is

A node is an abstraction that consists of a stream of bytes and a collection of subnodes. It is implemented by the NDB layer as a data block (section 2.2.2.8.3.1) and a subnode BTree (section 2.2.2.8.3.3). The NBTENTRY structures in the Node BTree (section 2.2.2.7.7.4) exist to define which blocks combine to form nodes.

As per the diagram here, you see that a node has the NID, bidData and bidSub as per your understanding.

A summary is a node made up of a data block or a data BTree which can point to data blocks and subnode BTree.

A subnode BTree contains SIBLOCK and SLBLOCK structures, which contain SIENTRY and SLENTRY structures.

Answering Question 2, Yes you can have a subnode Btree without a data BTree. Because a data tree is only one form of specifying bidData, the other is to specify the data block directory.

More specifically, in order to create a subnode as per 2.6.1.2.2, you are required to have a data block in order to associate the SLENTRY with it. This data block can be directly specified or can be datatree containing one or more external or internal data block references.

If your question is can we have a subnode Btree e.g. bidSub, without the relevant bidData being set, the answer is no as per above. If you have bidData initialised to 0x0 as per here for representing a placeholder Node that doesn't yet have a datablock, the SLENTRY's won't be associated with the placeholder Node, until a valid bidData is set.

Answering Question 3, Subnodes are used to divide data in to logical / hierarchical sections. I don't know your circumstances , so I can't really answer this question beyond the following answer.

You would have subnode trees, when you are needing to store data in PSTs that leads itself well to logical separation. Examples of existing use of subnodes are in Message object as per here to store attachments in the Messaging Layer , and in storing Table Contexts in the LTP layer as per here and for additional storage in Property Contexts as per here.

Answering Question 4, I don't understand what you mean by the term result. As far as I know combination of information from data trees and subnode trees happens at the LTP or Messaging Layers.

Answering Question 5, it really depends what you are doing ? The PST SDK provides a mechanism to iterate over nodes in a node database, a mechanism to read from the node a stream, rather than directly, it also provides a method to iterate over the the first level of subnodes as per here and here.

References (other than already linked)

Autorizzato sotto: CC-BY-SA insieme a attribuzione
Non affiliato a StackOverflow
scroll top