Skip to content
WMIparser

Glossary

OBJECTS.DATA

The WMI repository file that holds every class definition and instance in 8 KiB pages, including event filters, consumers and bindings.

OBJECTS.DATA is the main file of the CIM repository, in C:\Windows\System32\wbem\Repository. It stores every class definition and every instance of every namespace as records in 8 KiB pages. A page that starts records opens with a small table of contents: one 16-byte entry per record (record id, offset in the page, size, checksum), closed by an all-zero entry. A record too large for the rest of its page continues on the following logical pages.

Event filters, consumers and bindings are ordinary instances in it. An instance record starts with the hash of its class name, written as 64 UTF-16 characters (SHA-256; 32 characters of MD5 on Windows XP), followed by two undocumented FILETIMEs and the property values. Strings live in the record's heap as readable text.

Why it matters in investigations

It is where the evidence is. Freed pages and the unused tail of pages keep old records until WMI reuses the space, so deleted subscriptions and older versions of objects can often be carved. The class-name hash at the start of each instance makes records easy to find by scanning, even without the index, and the readable strings let a plain text search reveal command lines and binding references.

Keep its limits in mind. Records do not store their namespace; only INDEX.BTR knows it. Whether a record is live or freed comes from the current MAPPING file. And the two FILETIMEs are leads, not documented creation dates.

Example

The start of a __FilterToConsumerBinding instance record, and strings found further in its heap:

record header   UTF-16 hex SHA-256 of "__FILTERTOCONSUMERBINDING" (64 characters)
                FILETIME, FILETIME
heap strings    __EventFilter.Name="IntelPerfMonitor"
                CommandLineEventConsumer.Name="IntelPerfMonitor"

OBJECTS.DATA alone is enough to carve subscriptions like this one; add the index and maps to get namespaces and live or deleted status.

WMI Parser parses OBJECTS.DATA in the browser, by index and by carving. For its structure in detail, read Inside OBJECTS.DATA.