What Is an EDB File? The Exchange and Windows Database, and How to Open and Check One

7 How Do You Open EDB Files? Exchange, free readers and viewers

FileInfo's EDB entry lists no program for EDB files. We tested on Linux, so the table marks what we tested and what we did not. Listing an EDB file does not mean you can use it, so the next sections say which route fits which EDB file.

Open EDB files in Exchange

Exchange does not open a loose EDB file from a folder. It mounts databases that it knows. Microsoft's recovery database guide describes the way in for Exchange 2016 and 2019. A recovery database is separate from the live ones, and you mount it next to them.

1. 1 Copy the .edb file and its log files to one folder on the Exchange server. Work on the copy.
2. 2 If the file is dirty, replay the logs with Eseutil /R E00 /l "D:\RDB" /d "D:\RDB". E00 is the log prefix, and yours can differ.
3. 3 Create a recovery database with New-MailboxDatabase -Recovery -Name RDB1 -Server EX01 -EdbFilePath "D:\RDB\Mailbox Database.edb" -LogFolderPath "D:\RDB".
4. 4 Restart the information store with Restart-Service MSExchangeIS, then mount the database with Mount-Database RDB1.
5. 5 List the mailboxes with Get-MailboxStatistics -Database RDB1. Copy the GUID of the one you need.
6. 6 Restore it with New-MailboxRestoreRequest -SourceDatabase RDB1 -SourceStoreMailbox <GUID> -TargetMailbox user.

The guide says a restored database is always in a dirty shutdown state, so the log replay in step 2 is part of the job. The commands come from Microsoft and we did not use them. Check the exact names and paths against the guide for your Exchange version.

Open EDB files with free readers

Readers look inside an EDB file without a server. Install the Python modules with pip install libesedb-python dissect.esedb. The next script lists every table in an EDB file and counts its rows. It works on Windows, Mac and Linux.

from dissect.esedb import EseDB

with open('Catalog1.edb', 'rb') as fh:
    db = EseDB(fh)
    for table in db.tables():
        print(table.name, len(list(table.records())))

The next listing is what it printed for our Catalog1.edb file. The catalog table MSysObjects comes first, and the data tables follow it.

MSysObjects 128
MSysObjectsShadow 0
MSysObjids 26
MSysLocales 8
namespace 1373
string 994
file 912
backupset 150
global 20
library 14

Readers do not need the log files to look. They read what is in the EDB file, so a dirty EDB file can be missing the newest changes. Read the check section to see how to spot that.

View mailboxes in EDB files without Exchange

Viewers help when you need the mail inside an Exchange EDB file and have no Exchange server. Two Windows viewers come from the sites that this guide belongs to.

SysTools says its viewer opens EDB and STM files without Exchange Server and has an advanced scan for damaged files. Freeviewer says its viewer opens Priv1.edb, Pub1.edb and STM files and shows header, hex and MIME views. Both pages say the free version previews and does not save, so read the limits before you buy.

8 How Do You Check an EDB File? Read the state, the logs and the pages

The state field is the first thing to read. An EDB file in CleanShutdown has all its changes inside it. An EDB file in DirtyShutdown was in use when the power or the service stopped, and some changes live only in the log files. The next listing is an EDB file that closed the right way.

file         basic.edb (1048576 bytes)
signature    ef cd ab 89 OK
checksum     98a810d4 OK
version      0x620 revision 0x14
file type    database
state        CleanShutdown
detached     2022-08-19 11:46:33
logs needed  none
page size    4096 OK
header copy  same as the header
pages        23 in use, 0 bad 

The dirty files in our set look different in three lines. The state reads DirtyShutdown, the detach time reads never and the logs needed are not zero. All 4 of our dirty files showed that, and all 14 files that closed the right way showed none and a detach time.

file         Windows.edb (42008576 bytes)
signature    ef cd ab 89 OK
checksum     1306cd08 OK
version      0x620 revision 0x11
file type    database
state        DirtyShutdown
detached     never
logs needed  8 to 9
page size    32768 OK
header copy  same as the header
pages       skipped, this script checks 4096 byte pages only

The log numbers name the files to look for. This file needs log 8 and log 9. The dirty files in our set asked for logs 8 to 9, 11, 40 and 126, so the count is not a fixed number.

Check EDB files with Python

The script reads the header and checks it three ways. It compares the stored checksum with one it calculates and the header with its copy on the next page. Then it checks the checksum of every used page. It checks pages of 4 KB only, which is 12 of our 18 files.

import os, struct, sys

STATE = {1: 'JustCreated', 2: 'DirtyShutdown', 3: 'CleanShutdown', 4: 'BeingConverted', 5: 'ForceDetach'}


def when(b):
    if not any(b[:6]):
        return 'never'
    return '%04d-%02d-%02d %02d:%02d:%02d' % (1900 + b[5], b[4], b[3], b[2], b[1], b[0])


def xor_words(data, start, seed):
    x = seed
    end = start + (len(data) - start) // 4 * 4
    for (w,) in struct.iter_unpack('<I', data[start:end]):
        x ^= w
    return x


def check(path):
    size = os.path.getsize(path)
    data = open(path, 'rb').read()
    print('file        ', path, '(%d bytes)' % size)
    if len(data) < 668:
        print('problem      only %d bytes, the header needs 668' % len(data))
        return
    sig = data[4:8] == bytes.fromhex('efcdab89')
    print('signature   ', data[4:8].hex(' '), 'OK' if sig else 'WRONG, expected ef cd ab 89')
    if not sig:
        return
    stored = struct.unpack_from('<I', data, 0)[0]
    calc = xor_words(data[:4096], 4, 0x89ABCDEF)
    print('checksum    ', '%08x' % stored, 'OK' if calc == stored else 'WRONG, computed %08x' % calc)
    ver, ftype = struct.unpack_from('<II', data, 8)
    state, = struct.unpack_from('<I', data, 52)
    rev, page = struct.unpack_from('<II', data, 232)
    lo, hi = struct.unpack_from('<II', data, 296)
    print('version     ', hex(ver), 'revision', hex(rev))
    print('file type   ', {0: 'database', 1: 'streaming'}.get(ftype, ftype))
    print('state       ', STATE.get(state, state))
    print('detached    ', when(data[88:96]))
    print('logs needed ', 'none' if lo == hi == 0 else '%d to %d' % (lo, hi))
    if page not in (2048, 4096, 8192, 16384, 32768):
        print('page size   ', page, 'WRONG, expected 2048 to 32768')
        return
    print('page size   ', page, 'OK' if size % page == 0 else 'WRONG, the size is not a multiple of it')
    if size >= 2 * page:
        same = data[:page] == data[page:2 * page]
        print('header copy ', 'same as the header' if same else 'DIFFERENT from the header')
    if page != 4096:
        print('pages       skipped, this script checks 4096 byte pages only')
        return
    used = bad = 0
    first = []
    for off in range(2 * page, size - page + 1, page):
        pg = data[off:off + page]
        if not any(pg):
            continue
        used += 1
        num = off // page - 1
        if xor_words(pg, 8, num) != struct.unpack_from('<I', pg, 0)[0]:
            bad += 1
            first.append(num)
    print('pages       ', '%d in use, %d bad' % (used, bad), first[:5] if bad else '')


for p in sys.argv[1:]:
    check(p)
    print()

Here is what it printed for a page with one flipped byte, for a header with one flipped byte and for a genuine file with bad pages.

file         page-data-flipped.edb (1048576 bytes)
signature    ef cd ab 89 OK
checksum     98a810d4 OK
version      0x620 revision 0x14
file type    database
state        CleanShutdown
detached     2022-08-19 11:46:33
logs needed  none
page size    4096 OK
header copy  same as the header
pages        23 in use, 1 bad [27]

file         flipped-header-byte.edb (1048576 bytes)
signature    ef cd ab 89 OK
checksum     98a810d4 WRONG, computed 98a8102b
version      0x620 revision 0x14
file type    database
state        CleanShutdown
detached     2022-08-19 11:46:33
logs needed  none
page size    4096 OK
header copy  DIFFERENT from the header
pages        23 in use, 0 bad 

file         SRUDB.dat (655360 bytes)
signature    ef cd ab 89 OK
checksum     4dacb44a OK
version      0x620 revision 0x14
file type    database
state        CleanShutdown
detached     2021-11-16 20:21:00
logs needed  none
page size    4096 OK
header copy  same as the header
pages        95 in use, 16 bad [143, 144, 145, 146, 147]

The first listing names page 27 as bad, and the reader tools returned all 190 rows without a word. The second shows a wrong header checksum and a header that no longer matches its copy. The third is a genuine Windows file with 16 bad pages, so genuine files can fail the check and still be read by tools.

What the script found in 13 damaged copies

The script teaches and does not repair. It misses an EDB file that lost entire pages, and it skips 32 KB pages. Use it to read the state and to catch flipped bytes, and use Eseutil when a server is involved.

Check EDB files with Eseutil and Esentutl

Eseutil comes with Exchange and Esentutl comes with Windows. Microsoft's Eseutil guide says to start with /mh, because it shows the database state, a good shutdown or a dirty one. The /ml switch checks the log files.

eseutil /mh "Mailbox Database.edb"
eseutil /ml E00
esentutl /mh Windows.edb

Do not use /r or /p on your only copy. The /r switch replays the logs into the database. The /p switch is a hard repair, and Microsoft treats it as a last resort because it can delete data.

SANS adds that recovery changes the database and that log replay can include deletes. Copy the EDB file and its logs first.

If you need to read the log files themselves, the SysTools Exchange Log Analyzer opens edb.log files with the EDB file, according to SysTools. We did not test it.

9 Are EDB Files Safe to Open? The file is data, and the mail inside is the risk

The ending says nothing about safety. An EDB file is a database, and the safety depends on what went into it. The table lists what to check, and every row ends with its source.

Why a reader is safer than a server

A reader opens an EDB file and prints what it finds. A server attaches the EDB file, replays logs and writes to it.

Our readers did not change any of our EDB files. The SHA256 of all 18 files was the same before and after we used libesedb, dissect, impacket, file, 7-Zip and qemu-img. Use a reader first when you are not sure what an EDB file is.

Why you should check the first bytes

An EDB file that ends in .edb can be from another program. An ESE file has ef cd ab 89 at bytes 4 to 7, and the 69 line script tests that. A file with other bytes is not an ESE database, and no reader will open it.

11 How Do You Convert an EDB File? PST, CSV and single tables

There are two kinds of conversion. One moves the mail in an Exchange EDB file into a file Outlook reads. The other pulls a table out of any ESE file or EDB file. Choose by what you need next.

Convert EDB files to PST with Exchange

The cmdlet that exports to PST works on mailboxes that live in mounted databases. Microsoft's export guide says it needs the Mailbox Import Export role and a network share path that the Exchange Trusted Subsystem group can write to. So the way in is two steps after the recovery database. Our guide to convert EDB to PST covers all four ways and how to check the file you get.

New-MailboxRestoreRequest -SourceDatabase RDB1 -SourceStoreMailbox <GUID> -TargetMailbox restore1
New-MailboxExportRequest -Mailbox restore1 -FilePath \\SERVER01\PSTFiles\restore1.pst

The first line copies one mailbox from the recovery database into a spare mailbox. The second writes that mailbox to a PST file. We could not test these commands without a server, so check them against the Microsoft guides for your version.

Why ExMerge is not the answer

Old guides point to ExMerge. It targets Exchange 2003 and earlier and needs a mounted store, so it does not help with a loose file.

Convert a table to CSV with Python

Short scripts can pull a table out of any EDB file. This one writes the namespace table of our Catalog1.edb file to a CSV file. It reads the EDB file and does not change it.

import csv
from dissect.esedb import EseDB

with open('Catalog1.edb', 'rb') as fh, open('namespace.csv', 'w', newline='') as out:
    db = EseDB(fh)
    table = db.table('namespace')
    writer = csv.writer(out)
    writer.writerow([c.name for c in table.columns])
    for record in table.records():
        writer.writerow([record.get(c.name) for c in table.columns])

Convert EDB files without an Exchange server

A converter helps when you have the EDB file and no server. Freeviewer says its converter saves offline, damaged and dismounted EDB files to PST and other formats. Its demo exports 25 items per folder, so read the limits first.

For the other direction, Freeviewer has an EDB recovery page for damaged files. Its demo also stops at 25 items per folder, and we did not test it.