0

I'm using ManagedEsent Library to read data from Internet Explorer's Cache using the WebCacheV01.dat file. I get the exception below everytime, despite changing the WebCacheV01.dat severally from different machines.

Microsoft.Isam.Esent.Interop.EsentLogFileCorruptException: 'Log file is corrupt'

Has anyone else encountered this before? How did you go about it? I have attached a screenshot to show where the exception is thrown.enter image description here

Felix Too
  • 11,614
  • 5
  • 24
  • 25

1 Answers1

1

Many things going on here:

  • Creating the Instance is expensive. It should be done once, and reused. Every time you create an Instance it reads megabytes of log files to ensure that everything was cleaned up.
  • Session isn't too expensive. If you have a server-scale application, then you should reuse sessions, but at small scale it doesn't matter much.
  • You aren't setting the parameters to the Instance, such as the log file path, the log file prefix (I think its v01 for webcache?)
  • Check out the Windows Application event viewer, looking for category ESENT events. The exact log file location should be present in the event log entries.
  • It is not supported to directly access these files. If you modify the files, then the web cache may malfunction.
  • If it's for forensic purposes, then open up a case with MS and get the forensics folks involved. There is supposed to be a channel to help law-enforcement folks do their jobs.
  • You mentioned different machines. If you copy the files from a different machine, then it may be in a different format that an older version of windows simply doesn't understand. esent.dll can read older files, but not files from the future.

Hope that helps,

-martin

Martin Chisholm
  • 461
  • 2
  • 6