2.2.2.3 EFSRPC Metadata Version 3

This metadata format is specified by EFS Version 6 in the EFSRPC Metadata header<18>. This new metadata format is referred to as "Version 3" of the EFSRPC Metadata, but do not confuse this with the EFS Version field specified within the metadata header. The format used for Version 3 EFSRPC metadata is significantly different from Version 1 described in section 2.2.2.1, or Version 2 described in section 2.2.2.2. Servers SHOULD support Version 3 of the EFSRPC Metadata.<19> A server that supports Version 3 of the EFSRPC Metadata MUST also fully support EFSRPC Metadata Version 1 and EFSRPC Metadata Version 2.

0	1	2	3	4	5	6	7	8	9	1 0	1	2	3	4	5	6	7	8	9	2 0	1	2	3	4	5	6	7	8	9	3 0	1
Preamble
...																MajorVersion
...																MinorVersion
...																ClearTextRedirectionLength
...																ClearTextRedirectionString (variable)
...
TotalHeaderLength
OriginalFileExtensionOffset
OriginalFileExtensionLength
PLOffset
EncryptedDataOffset
OriginalFileSize
...
MetaDataOffset
MetaDataLength
OriginalFileExtensionData (variable)
...
PLData (variable)
...
MetaData (variable)
...
EncryptedData (variable)
...

Preamble (6 bytes): This field is used to identify the EFSRPC Metadata Version 3. This field MUST be set to 0x2E, 0x70, 0x66, 0x69, 0x6C, 0x65. This will appear as the string ".pfile" in ASCII.

MajorVersion (4 bytes): This field is used to identify the major version of the EFSRPC Metadata Version 3. This field MUST be set to 2.

MinorVersion (4 bytes): This field is used to identify the minor version of the EFSRPC Metadata Version 3. This field MUST be set to 1.

ClearTextRedirectionLength (4 bytes): The length, in bytes, of the ClearTextRedirectionString field.

ClearTextRedirectionString (variable): An optional string in UTF-8 format.

TotalHeaderLength (4 bytes): The length, in bytes, of the OriginalFileExtensionOffset, OriginalFileExtensionLength, PLOffset, EncryptedDataOffset, OriginalFileSize, MetaDataOffset, MetaDataLength, OriginalFileExtensionData, PLData, and MetaData fields.

OriginalFileExtensionOffset (4 bytes): The offset, in bytes, from the beginning of the Preamble field to the OriginalFileExtensionData field.

OriginalFileExtensionLength (4 bytes): The length, in bytes, of the OriginalFileExtensionData field.

PLOffset (4 bytes): The offset, in bytes, from the beginning the Preamble field to the PLData field.

EncryptedDataOffset (4 bytes): The offset, in bytes, from the beginning of the Preamble field to the EncryptedData field.

OriginalFileSize (8 bytes): The length, in bytes, of the plaintext of the file prior to encryption, formatted as a ULONGLONG (unsigned 64-bit integer as described in section [MS-DTYP] section 2.2.55).

MetaDataOffset (4 bytes): The offset, in bytes, from the beginning of the Preamble field to the MetaData field, formatted as a ULONGLONG (unsigned 64-bit integer as described in section [MS-DTYP] section 2.2.55).

MetaDataLength (4 bytes): The length, in bytes, of the MetaData field.

OriginalFileExtensionData (variable): A UNICODE string storing the original file extension, including the leading period of the file defined in the EncryptedData field.

PLData (variable): This is a Rights Management Services Publishing License, as defined in [MS-RMPR] section 2.2.9.7.

MetaData (variable): This field contains application-specific metadata information of the file defined in the EncryptedData field.

EncryptedData (variable): The encrypted data representing the file. This field's size MUST be a multiple of the encryption algorithm block size.