2.2 Compound File Header

  • Article

The Compound File Header structure MUST be at the beginning of the file (offset 0).


0


1


2


3


4


5


6


7


8


9

1
0


1


2


3


4


5


6


7


8


9

2
0


1


2


3


4


5


6


7


8


9

3
0


1

Header Signature

...

Header CLSID (16 bytes)

...

...

Minor Version

Major Version

Byte Order

Sector Shift

Mini Sector Shift

Reserved

...

Number of Directory Sectors

Number of FAT Sectors

First Directory Sector Location

Transaction Signature Number

Mini Stream Cutoff Size

First Mini FAT Sector Location

Number of Mini FAT Sectors

First DIFAT Sector Location

Number of DIFAT Sectors

DIFAT (436 bytes)

...

...

Header Signature (8 bytes): Identification signature for the compound file structure, and MUST be set to the value 0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1.

Header CLSID (16 bytes): Reserved and unused class ID that MUST be set to all zeroes (CLSID_NULL).

Minor Version (2 bytes): Version number for nonbreaking changes. This field SHOULD be set to 0x003E if the major version field is either 0x0003 or 0x0004.

Value

Meaning

0x003E

If major version field is either 0x0003 or 0x0004.

Major Version (2 bytes): Version number for breaking changes. This field MUST be set to either 0x0003 (version 3) or 0x0004 (version 4).

Name

Value

version 3

0x0003

version 4

0x0004

Byte Order (2 bytes): This field MUST be set to 0xFFFE. This field is a byte order mark for all integer fields, specifying little-endian byte order.

Sector Shift (2 bytes): This field MUST be set to 0x0009, or 0x000c, depending on the Major Version field. This field specifies the sector size of the compound file as a power of 2.

  • If Major Version is 3, the Sector Shift MUST be 0x0009, specifying a sector size of 512 bytes.

  • If Major Version is 4, the Sector Shift MUST be 0x000C, specifying a sector size of 4096 bytes.

    Value

    Meaning

    Major Version 3

    0x0009

    If Major Version is 3, the Sector Shift MUST be 0x0009, specifying a sector size of 512 bytes.

    Major Version 4

    0x000C

    If Major Version is 4, the Sector Shift MUST be 0x000C, specifying a sector size of 4,096 bytes.

Mini Sector Shift (2 bytes): This field MUST be set to 0x0006. This field specifies the sector size of the Mini Stream as a power of 2. The sector size of the Mini Stream MUST be 64 bytes.

Reserved (6 bytes): This field MUST be set to all zeroes.

Number of Directory Sectors (4 bytes): This integer field contains the count of the number of directory sectors in the compound file.

  • If Major Version is 3, the Number of Directory Sectors MUST be zero. This field is not supported for version 3 compound files.

    Value

    Meaning

    0x00000000

    If Major Version is 3, the Number of Directory Sectors MUST be zero.

Number of FAT Sectors (4 bytes): This integer field contains the count of the number of FAT sectors in the compound file.

First Directory Sector Location (4 bytes): This integer field contains the starting sector number for the directory stream.

Transaction Signature Number (4 bytes): This integer field MAY contain a sequence number that is incremented every time the compound file is saved by an implementation that supports file transactions. This is the field that MUST be set to all zeroes if file transactions are not implemented.<1>

Mini Stream Cutoff Size (4 bytes): This integer field MUST be set to 0x00001000. This field specifies the maximum size of a user-defined data stream that is allocated from the mini FAT and mini stream, and that cutoff is 4,096 bytes. Any user-defined data stream that is greater than or equal to this cutoff size must be allocated as normal sectors from the FAT.

First Mini FAT Sector Location (4 bytes): This integer field contains the starting sector number for the mini FAT.

Number of Mini FAT Sectors (4 bytes): This integer field contains the count of the number of mini FAT sectors in the compound file.

First DIFAT Sector Location (4 bytes): This integer field contains the starting sector number for the DIFAT.

Number of DIFAT Sectors (4 bytes): This integer field contains the count of the number of DIFAT sectors in the compound file.

DIFAT (436 bytes): This array of 32-bit integer fields contains the first 109 FAT sector locations of the compound file.

  • For version 4 compound files, the header size (512 bytes) is less than the sector size (4,096 bytes), so the remaining part of the header (3,584 bytes) MUST be filled with all zeroes.


    0


    1


    2


    3


    4


    5


    6


    7


    8


    9

    1
    0


    1


    2


    3


    4


    5


    6


    7


    8


    9

    2
    0


    1


    2


    3


    4


    5


    6


    7


    8


    9

    3
    0


    1

    DIFAT[0]

    DIFAT[1]

    ... DIFAT[N] (variable)

    DIFAT[107]

    DIFAT[108]