Unable to parse Windows 11 24H2 ESE db file #75
Description
👋 Hello, I just wanted to open a small issue I recently encountered when reviewing an ESE database on Windows 11 version 24H2.
Attempting to run esedbinfo and esedbexport on a Windows 11 24H2 ESE db results in both tools returning errors
./esedbinfo qmgr.db
esedbinfo 20240420
Unable to open: qmgr.db.
libesedb_page_read_tags: invalid number of page tags value out of bounds.
libesedb_page_read_values: unable to read page tags.
libesedb_page_read_file_io_handle: unable to read page values.
libesedb_io_handle_read_page: unable to read page.
libfdata_vector_get_element_value_by_index: unable to read element data at offset: 81920 (0x00014000).
libesedb_page_tree_get_get_first_leaf_page_number: unable to retrieve page: 4.
libesedb_catalog_read_file_io_handle: unable to retrieve first leaf page number from page tree.
libesedb_file_open_read: unable to read catalog.
libesedb_file_open_file_io_handle: unable to read from file handle.
libesedb_file_open: unable to open file: qmgr.db.
info_handle_open: unable to open input file.
Attached the qmgr.db file that triggers the error
Other ESE parsers also had issues with Windows 11 24H2 and needed to be updated.
I used the ESE format documentation alot when making my own ESE parser, so I just wanted to give you a heads up about this issue.
Let me know if more info is required