Glossary
INDEX.BTR
The WMI repository's B-tree index: text keys made of hashed namespace, class and instance names that point to records in OBJECTS.DATA.
INDEX.BTR is the B-tree index of the CIM repository. It is stored in 8 KiB pages, like OBJECTS.DATA, and holds text keys. Each key is a path of hashed names that ends with the location of a record: its logical page, its record id and its length. Following a key through the current MAPPING file leads to the right bytes in OBJECTS.DATA.
Every part of a key is a prefix plus the upper-case hex SHA-256 of the upper-cased name (MD5 on Windows XP and Server 2003). NS_ marks a namespace, CD_ a class definition, and CI_ followed by IL_ an instance of a class.
Why it matters in investigations
The index is what separates live objects from deleted ones. A record that a key references, through a page the current map still uses, is live; a record found only by scanning is freed or superseded. The index also gives each object its namespace, something the records themselves do not store. Without it, a carved subscription cannot be placed in root\subscription or elsewhere.
Because names are hashed, the index never contains a readable namespace or class name. Readable names come from __NAMESPACE instances and from the class definitions. And because it must match the map and the data file, INDEX.BTR is only reliable when all repository files were collected at the same instant.
Example
Two keys, with the hashes written as functions of the names they encode:
NS_<h("ROOT\SUBSCRIPTION")>/CD_<h("COMMANDLINEEVENTCONSUMER")>.268.2079887499.561
NS_<h("ROOT\SUBSCRIPTION")>/CI_<h("__EVENTFILTER")>/IL_<h(key)>.271.2079886610.299
The first is the class definition of CommandLineEventConsumer in root\subscription; the second an __EventFilter instance. The suffix reads logical page 271, record id 2079886610, 299 bytes.
Related terms
WMI Parser walks this index when INDEX.BTR and a MAPPING file are present, then carves the whole data file. For the format in depth, read Inside OBJECTS.DATA.