ESE database (Extensible Storage Engine)

The Extensible Storage Engine (ESE, historically called JET Blue) is Microsoft's embedded, transactional database engine. Several key Windows artifacts are ESE databases: SRUM (SRUDB.dat), the WebCacheV01.dat history store used by Internet Explorer and legacy Edge, the Windows Search index Windows.edb (Windows 11 22H2 moved to SQLite), and the BITS queue qmgr.db on Windows 10 and later.

ESE writes changes to transaction log files (for example SRU.log or V01.log) and a checkpoint file (.chk) before flushing them into the database. A copy taken from a running system is therefore usually in a dirty shutdown state: recent records may exist only in the logs, and some parsers refuse to open the file.

Check the state with esentutl /mh <database>, which prints the header including State: Dirty Shutdown or Clean Shutdown. To bring a copy to a clean state, place the database, its logs and checkpoint together and run a soft recovery with esentutl /r <base>, where the base name is the log prefix (SRU for SRUM, V01 for WebCache). Avoid esentutl /p, a hard repair that can discard data, unless nothing else works.

Always operate on copies, never on original evidence, and collect the logs alongside the database. Because ESE files are locked while in use, collection relies on raw NTFS access, esentutl /y /vss or a volume shadow copy. SQLite-based artifacts have a comparable pitfall with the write-ahead log.