<div class="content" name="Blob_Datum" uuid="b5a69be6-4759-4dfb-9e66-b37dfcd8529e"><p>  </p><p>The Blob Datum encapsulates an opaque binary object. It MUST
be formatted as below.</p><table>
 <tbody><tr>
  <th><p><br/>0</p></th>
  <th><p><br/>1</p></th>
  <th><p><br/>2</p></th>
  <th><p><br/>3</p></th>
  <th><p><br/>4</p></th>
  <th><p><br/>5</p></th>
  <th><p><br/>6</p></th>
  <th><p><br/>7</p></th>
  <th><p><br/>8</p></th>
  <th><p><br/>9</p></th>
  <th><p>1<br/>0</p></th>
  <th><p><br/>1</p></th>
  <th><p><br/>2</p></th>
  <th><p><br/>3</p></th>
  <th><p><br/>4</p></th>
  <th><p><br/>5</p></th>
  <th><p><br/>6</p></th>
  <th><p><br/>7</p></th>
  <th><p><br/>8</p></th>
  <th><p><br/>9</p></th>
  <th><p>2<br/>0</p></th>
  <th><p><br/>1</p></th>
  <th><p><br/>2</p></th>
  <th><p><br/>3</p></th>
  <th><p><br/>4</p></th>
  <th><p><br/>5</p></th>
  <th><p><br/>6</p></th>
  <th><p><br/>7</p></th>
  <th><p><br/>8</p></th>
  <th><p><br/>9</p></th>
  <th><p>3<br/>0</p></th>
  <th><p><br/>1</p></th>
 </tr>
 <tr>
  <td colspan="32">EFSX_Datum</td>
 </tr>
 <tr>
  <td colspan="32">...</td>
 </tr>
 <tr>
  <td colspan="16">BlobType</td>
  <td colspan="16">BlobFlags</td>
 </tr>
 <tr>
  <td colspan="32">Blob_Data (variable)</td>
 </tr>
 <tr>
  <td colspan="32">...</td>
 </tr>
</tbody></table><p><b>EFSX_Datum (8 bytes): </b>MUST be formatted as
specified in section <a href="1d2fa232-d557-43fe-95e3-2d4ced7f7934" data-linktype="relative-path">2.2.2.2.2</a>.
The datum Type MUST be EFSX_TYPE_BLOB (0x0001). The datum <b>Flags</b> MUST NOT
include 0x0002.</p><p><b>BlobType (2 bytes): </b>The type of the blob,
which provides a hint to the format of the <b>Blob Data</b>. It MUST be a
16-bit unsigned integer in little-endian format.</p><dl>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Value</p>
   </th>
   <th>
   <p>Meaning</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>0x0000</td>
  <td>The blob has no special formatting.</td>
 </tr><tr>
  <td>0x0001</td>
  <td>The blob contains a public key formatted as a BCRYPT_PUBLIC_KEY_BLOB.</td>
 </tr><tr>
  <td>0x0002</td>
  <td>The blob contains a SHA-1 hash of a DER-encoded form of a certificate.</td>
 </tr><tr>
  <td>0x0003</td>
  <td>The blob contains the encrypted form of an Encrypted FEK structure, as defined in section 2.2.2.1.5. The contents of the key can be either the FEK or the FMK (see section 2.2.2.2.5).</td>
 </tr><tr>
  <td>0x0004</td>
  <td>The blob contains key material wrapped with an AES-256 key wrapping key, as defined by [RFC3394].</td>
 </tr><tr>
  <td>0x0005</td>
  <td>The blob contains key material encrypted by a DPAPI-NG provider on the endpoint. This BlobType MUST only be used when EFS_VERSION is 5.&lt;17&gt;</td>
 </tr></tbody></table>
</dd></dl><p><b>BlobFlags (2 bytes): </b>Reserved, MUST be 0x0000.</p><p><b>Blob_Data (variable): </b>Contains opaque,
variable-length data. The <b>Blob Data</b> MUST be entirely contained within
the Blob Datum.</p></div>