尝试打开IE 10/11 WebCache.dat时，ESENT总是抛出EsentPageSizeMismatchException [英] ESENT Always throws EsentPageSizeMismatchException when trying to open IE 10/11 WebCache.dat

问题描述

我试图创建一个Powershell脚本来读取IE 10/11的Internet历史记录，该历史记录存储在AppData \ Local \ Microsoft \ Windows \ WebCache \ WebCache.dat中.

I am trying to create a powershell script to read the IE 10/11 internet history, which is stored in AppData\Local\Microsoft\Windows\WebCache\WebCache.dat.

我正在使用 Managed Esent +-以与.NET中的Win32 Jet API进行交互.

I am using Managed Esent+- to interface with the Win32 Jet api in .NET.

我的问题是，我永远无法真正打开数据库，因为在调用JetAttachDatabase时会抛出EsentPageSizeMismatchException.在对该错误进行了一些研究之后，我发现IE WebCache的页面大小为32K.当我尝试纠正此问题时，通过将DatabasePageSize系统参数设置为0x8000，JetInit开始引发相同的异常.

My issue is that I can never actually open the database, as EsentPageSizeMismatchException is thrown when I call JetAttachDatabase. After doing some research on this error, I found that the IE WebCache has a page size of 32K. When I attempted to correct for this, by setting the DatabasePageSize system parameter to 0x8000, JetInit started to throw the same exception.

这是我的代码

#stop the things locking the database
stop-process -name taskhost
stop-process -name dllhost
#give powershell access to the interop dlls
add-type -path "$PSScriptRoot\ManagedEsent 1.6\Esent.Interop.dll"
$instance = [Microsoft.Isam.Esent.Interop.JET_INSTANCE]::Nil
#set page size
[Microsoft.Isam.Esent.Interop.api]::JetSetSystemParameter(
    $instance,
    [Microsoft.Isam.Esent.Interop.JET_SESID]::Nil,
    [Microsoft.Isam.Esent.Interop.JET_param]::DatabasePageSize,
    0x8000,
    $null
)
[Microsoft.Isam.Esent.Interop.Api]::JetCreateInstance([ref]$instance,"testing")
# init the instance, throws EsentPageSizeMismatchException if the page size is not default
[Microsoft.Isam.Esent.Interop.Api]::JetInit([ref]$instance) 
$sesid = [Microsoft.Isam.Esent.Interop.JET_SESID]::Nil
[Microsoft.Isam.Esent.Interop.Api]::JetBeginSession($instance,[ref]$sesid,$null,$null)
# throws EsentPageSizeMismatchException if page size is default
[Microsoft.Isam.Esent.Interop.api]::JetAttachDatabase(
   $sesid,
   "C:\Users\Administrator\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat",
   [Microsoft.Isam.Esent.Interop.AttachDatabaseGrbit]::ReadOnly
)
...

似乎ESENT引擎不喜欢具有非默认页面大小，但是我已经在互联网上进行搜索，而且似乎没有改变引擎页面大小的方法.是什么导致此错误?

It seems like the ESENT engine does not like having the non-default page size, but I've scoured the internet and there doesn't seem to be a way to change the engine page size. What is causing this error?

推荐答案

如果您注意到，在一种情况下，是JetAttachDatabase失败，并出现异常，而JetInit在另一种情况下.

If you notice, in one case it's JetAttachDatabase that fails with the exception, and JetInit in the other.

您确实确实需要设置DatabasePageSize. JetInit实际上是一个不好的名字.它应该被称为JetInitAndReplayLogFiles之类的东西.它将查看日志目录(默认值:.")中的事务日志文件(默认名称edb * .log)，并重播事务日志文件中的操作.

You are indeed correct that you need to set DatabasePageSize. JetInit is actually a poor name. It should be called something like JetInitAndReplayLogFiles. It will look at the transaction log files (default name of edb*.log) in the log directory (default: "."), and replay the operations within the transaction log files.

您现在可能正在拾取以不同页面大小创建的其他事务日志文件.理论:您将拾取第一次尝试时无意创建的edb*.log文件.

You are probably now picking up other transaction log files created with a different page size. Theory: you're picking up the edb*.log files you unintentionally created during your first attempt.

一些潜在的解决方案:

-cd首先进入包含日志文件的目录.

-cd in to the directory that contains the log files first.

-更改LogFileDirectory(可以将JetSetSystemParameter与JET_param.LogFilePath一起使用，也可以使用包装器类InstanceParameters.LogFileDirectory).哦，您还需要将InstanceParameters.BaseName设置为"v01"，因为这就是webcache01.dat文件似乎要使用的文件(影响"edb.log"和"v01.log"的名称).

-Change the LogFileDirectory (You can either use JetSetSystemParameter with JET_param.LogFilePath, or the wrapper class InstanceParameters.LogFileDirectory). Oh, you'll also need to set InstanceParameters.BaseName to "v01", since that's what the webcache01.dat file seems to use (Affects the names of "edb.log" versus "v01.log").

-使用esentutl.exe -r v01将数据库置于干净关闭"状态，然后将InstanceParameters.Recovery设置为false以避免意外创建新的事务记录文件.而且我看到您已经加入AttacheDatabaseGrbit.ReadOnly.

-Use esentutl.exe -r v01 to bring the database to a 'clean shutdown' state, and then set InstanceParameters.Recovery to false to avoid creating new transacation log files accidentally. And I see you're already attaching with AttacheDatabaseGrbit.ReadOnly.

最后，我希望这只是出于好奇.用于inetcache的人员可以随时更改实现细节.如果是出于法医目的，Microsoft会协助执法机构进行法医工作.

Finally, I hope this is just for curiosity. The people who worked on the inetcache can change the implementation details at any time. If it's for forensic purposes, Microsoft does assist forensic efforts by law enforcement agencies.

-马丁

这篇关于尝试打开IE 10/11 WebCache.dat时，ESENT总是抛出EsentPageSizeMismatchException的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！