Sorry, sparse file was the wrong word. All of the storage is allocated as the file is opened. It'll contain whatever was on disk. I know there is a word for that, but I spaced on it.
Then "stuff" gets written to it. I can't find any public resource that says what the "stuff" is. I have documentation from the Exchange Center of Excellence (almost 10 years old and may no longer be accurate) that says it's 0xdeadbeef, except for the CRC which is whatever it should be for a block full of 0xdeadbeef and the required pointers. Regardless, after a database shutdown, even a non-clean shutdown, all of the *tmp.log and *tmp.edb files can be removed. They are no longer used and will be removed by the DB engine itself upon next startup, if they are found to exist - this is because their contents can't be assured as they are not subject to ACID. You CAN find information about that, with a little reading between the lines, at these locations: http://msdn.microsoft.com/en-us/library/gg294069(v=EXCHG.10).aspx http://support.microsoft.com/kb/197971 http://technet.microsoft.com/en-us/library/bb124808(EXCHG.65).aspx http://support.microsoft.com/kb/319785 Regards, Michael B. Smith Consultant and Exchange MVP http://TheEssentialExchange.com -----Original Message----- From: Ben Scott [mailto:[email protected]] Sent: Wednesday, June 29, 2011 1:17 PM To: NT System Admin Issues Subject: Re: Is this a valid file? On Wed, Jun 29, 2011 at 12:42 PM, Michael B. Smith <[email protected]> wrote: >> I don't think Microsoft documents the format of this file. > > Just to be a pedant: there is extensive documentation on the > format of ESE files and their log files. I couldn't find anything that talked about the format of TMP.EDB. Some of the other stuff gets a fair deal of coverage, but that file wasn't covered in anything I found, other than mere mentions that it might exist. Now, I'm just using a Microsoft site search. Could well be there's stuff out there that's not finding. > Now, that being said, tmp.edb is the NORMAL name for a the file that the > ESE subsystem is writing and preparing to be the NEXT ESE log. It should > be created in the same folder as any other *.log files for the ESE database. > It may not be a valid ESE file because the file is created as a sparse file > (which means it has garbage) ... My understanding of sparse files is that they don't allocate blocks which are all zeros. Reading from those blocks should return zeros as well. There's no allocation on disk until data is written, so there's not even garbage to return, so to speak. That said, I haven't tested it. :) > ... then block-by-block is overwritten with a specific bit-pattern. Any idea what that bit pattern might be? If we knew what it's supposed to look like, we could know with some surety if the file in question is legit. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin
