How to read from an EDB database file

Question

Microsoft Edge and other Microsoft products use an Extensible Storage Engine. If you have edge installed on windows, you can find the database file here:

C:\Users\username\AppData\Local\Packages\Microsoft.MicrosoftEdge_xxxxxxx\AC
\MicrosoftEdge\User\Default\DataStore\Data\nouser1\xxxxxxxx\DBStore\spartan.edb

I would like to read this database from my .NET app.

The only tool I have seen for viewing this data appears to be deprecated:

http://www.woanware.co.uk/forensics/esedbviewer.html

I can't seem to find any relevant nuget packages for querying this type of database. Does anyone have experience working with this type of database?

Answer 1

The database engine is esent.dll, and you can access it in several different ways:

• C API. https://msdn.microsoft.com/en-us/library/gg269259(v=exchg.10).aspx
• C#. https://github.com/microsoft/managedesent
• Simplified C# (Isam layer). Easier to use, but not everything is exposed. https://github.com/Microsoft/ManagedEsent/tree/master/isam

(Disclosure: I've worked on the above products.)

That being said, if you just modify a random database, you can impact the host process's integrity, and it might end up crashing.

If you're a law-enforcement agent and it's for forensic purposes, Microsoft should be able to assist you (I haven't done it myself, but I've heard that they'll do it).

-martin