Skip to content
WMIparser

Glossary

MAPPING1.MAP, MAPPING2.MAP, MAPPING3.MAP

The WMI repository's page maps: they translate logical page numbers of OBJECTS.DATA and INDEX.BTR into physical pages. Three generations are kept.

The MAPPING files are the page maps of the CIM repository. INDEX.BTR refers to records by logical page number; a MAPPING file says where each logical page physically sits in OBJECTS.DATA, and does the same for the index's own pages. Each file therefore holds two maps, first for OBJECTS.DATA and then for INDEX.BTR. Each map opens with the signature 0xABCD and a version number, lists one entry per logical page, then a list of free pages, and closes with 0xDCBA. A special value marks a logical page that is not mapped.

Windows keeps three generations, MAPPING1.MAP to MAPPING3.MAP, so it can recover from a failed write. The file with the highest version is the current one; the others describe earlier states of the repository.

Why it matters in investigations

The current map decides what is live. A physical page of OBJECTS.DATA that no entry references is free, and free pages keep whatever was written there last, including deleted filters, consumers and bindings. Recovery tools use this to label every carved record: inside a mapped page and its table of contents, it is in use; in an unmapped page or in page slack, it was freed.

The map must match the other files. If INDEX.BTR is newer than the map, keys point to the wrong physical pages, and the structured view breaks while carving still works. Collect the whole folder from a single shadow copy.

Example

How one lookup resolves, step by step:

INDEX.BTR key   .../IL_<hash>.271.2079886610.299   -> logical page 271
MAPPING (current, highest version): entry 271       -> physical page P
OBJECTS.DATA    offset P x 8192, table of contents  -> record 2079886610

WMI Parser picks the current map automatically and uses it to tell live objects from recovered ones. For how freed pages are carved, read recovering deleted WMI persistence.