How to read the string value from ESE database file using ESE CPP apis?

Question

I am parsing the ESE database file i.e WebCacheV01.dat. This is the file where the IE 10 started storing all the browsing history and other information. I am using JET Blue CPP apis to parse this file.

I can read any column value of type integer or long but can not read the column value of type string.

For example I have opened the "MSysObjects" table and want to retrieve the value of "Name" column.

Here is the sample code

 for( err = ::JetMove( sessionID, tableId, JET_MoveFirst, 0 );
        JET_errSuccess == err;
        err = ::JetMove( sessionID, tableId, JET_MoveNext, 0 ) )
    {
        JET_COLUMNID columnid = 12/*columnid of the Name column*/;
        char *pszBuff = new char[2048];
        if( pszBuff )
        {
            long lReadBytes;
             memset(pszBuff, 0, 2048);
             err = ::JetRetrieveColumn( sessionID,
               tableId,
                columnid,
                pszBuff,
                2047,
               &lReadBytes,
               0,
               NULL);
            delete[] pszBuff;
        }
    }

The return value of JetRetrieveColumn is -1507 which is nothing but JET_errColumnNotFound. I have verified using ESEDatabaseViewer tool that the MSysObjects table contains the 25 columns. That means the columnd 18 is not invalid.

Please let me know if anyone has any idea how to retrieve the string values from ESE database.

Thanking you in advance.

Answer 1

After spending almost two days, I have finally figured out how to read the values properly from ESE database table. I was thinking that columnid is in sequence and hence I was determining the columnid by counting the specific column location in "ESEDatabaseView" tool.

But it is not like that. The proper way of getting columnid is to call the JetGetTableColumnInfo method by specifying the name of the column. After getting the columnid, use that in JetRetrieveColumn methos to retrieve the column value.

Here is the corrected code

for( err = ::JetMove( jetSessionId, jetContainersTableId, JET_MoveFirst, 0 );
    JET_errSuccess == err;
    err = ::JetMove( jetSessionId, jetContainersTableId, JET_MoveNext, 0 ) )
{
    unsigned long nReadBytes = 0;

    JET_COLUMNDEF colName;
    err = ::JetGetTableColumnInfoW(jetSessionId, jetContainersTableId, L"Name", (void *)&colName, sizeof(JET_COLUMNDEF), JET_ColInfo);

    wchar_t szName[MAX_PATH] = {0};
    if( JET_errSuccess == err )
    {
        err = ::JetRetrieveColumn(jetSessionId, jetContainersTableId, colName.columnid, szName, sizeof(szName) , &nReadBytes, 0, NULL);
    }
}

This may help someone who is working on the ESE database.