Module Contents



Represents an index on a table.



Encode various values into their normalized index key form.


dissect.esedb.index.JET_cbKeyMost_OLD = 255
class dissect.esedb.index.Index(table: dissect.esedb.table.Table, record: dissect.esedb.record.Record = None)

Bases: object

Represents an index on a table.

This is still very much WIP but works for basic indexes. For example, none of the special flags are currently implemented.

  • table – The table this index is from.

  • record – The record in the catalog for this index.

root() dissect.esedb.page.Page

Return the root page of this index.

column_ids() list[int]

Return a list of column IDs that are used in this index.

columns() list[dissect.esedb.table.Column]

Return a list of all columns that are used in this index.

search(**kwargs) dissect.esedb.record.Record

Search the index for the requested values.

Specify the column and value as a keyword argument.

search_key(key: bytes) dissect.esedb.page.Node

Search the index for a specific key.


key – The key to search for.

key_from_record(record: dissect.esedb.record.Record) bytes

Generate a key for this index from a record.


record – The record to generate a key for.

make_key(values: dict[str, dissect.esedb.c_esedb.RecordValue]) bytes

Generate a key out of the given values.


values – A map of the column names and values to generate a key for.

__repr__() str

Return repr(self).

dissect.esedb.index.bPrefixNull = 0
dissect.esedb.index.bPrefixZeroLength = 64
dissect.esedb.index.bPrefixNullHigh = 192
dissect.esedb.index.bPrefixData = 127
dissect.esedb.index.bSentinel = 255
dissect.esedb.index.encode_key(index: Index, column: dissect.esedb.table.Column, value: dissect.esedb.c_esedb.RecordValue, max_size: int) bytes

Encode various values into their normalized index key form.

  • column – The column of the value to encode.

  • value – The value that needs encoding.

  • max_size – The maximum key segment size.