esedb-columns

Retrieves the list of column definitions for a specified table in an ESE (Extensible Storage Engine) database file. Returns the identifier, name, and data type of each column.

Command properties

Item	Description
Command type	Driver query
Required permission	None
License usage	Counted
Parallel execution	Not supported
Distributed execution	Runs on Data Node (mapper)

Syntax

esedb-columns [table=STR] FILE_PATH

Options

table=STR: Name of the ESE database table whose column definitions to retrieve. If not specified, retrieves column definitions for all tables.

Target

FILE_PATH: Path to the ESE database file to query. You can use a wildcard (*) to specify multiple files.

Output fields

Field	Type	Description
`_file`	string	ESE database file name
`table_name`	string	Table name
`column_id`	integer	Column identifier
`column_name`	string	Column name
`column_type`	string	Column data type. Returns `unknown` if the type cannot be determined

Error codes

Parse errors

N/A

Runtime errors

Error code	Message	Description	Post-processing
-	cannot load ESE DB file: [path]	Unable to read the ESE database file	Stops query execution

Description

The esedb-columns command opens an ESE database file and retrieves column definitions for the specified table. ESE is the built-in database engine used in Windows operating systems, and is used in various Windows artifacts such as the Internet Explorer browsing history (WebCacheV01.dat) and the Windows Search index (Windows.edb).

When you specify the table option, only the columns for that table are retrieved. If not specified, column definitions are retrieved for all tables in the database.

You can use this command to inspect the schema of a table before querying its records with the esedb-records command.

Examples

Retrieve columns for a specific table in an ESE database
```
esedb-columns table=Containers /opt/logpresso/evidence/WebCacheV01.dat
```
Retrieves the list of columns defined in the Containers table of the WebCacheV01.dat file.
Retrieve columns for all tables
```
esedb-columns /opt/logpresso/evidence/WebCacheV01.dat
```
Omits the table option to retrieve column definitions for all tables in the database.
Retrieve columns from multiple ESE database files
```
esedb-columns table=SystemIndex_PropertyStore /opt/logpresso/evidence/*.edb
```
Retrieves column definitions for the SystemIndex_PropertyStore table from all EDB files in the specified directory.