<div class="content"><p>  </p><p>The Blob Datum encapsulates an opaque binary object. It MUST
be formatted as below.</p><table>
 <tbody><tr>
  <th><p><br/>0</p></th>
  <th><p><br/>1</p></th>
  <th><p><br/>2</p></th>
  <th><p><br/>3</p></th>
  <th><p><br/>4</p></th>
  <th><p><br/>5</p></th>
  <th><p><br/>6</p></th>
  <th><p><br/>7</p></th>
  <th><p><br/>8</p></th>
  <th><p><br/>9</p></th>
  <th><p>1<br/>0</p></th>
  <th><p><br/>1</p></th>
  <th><p><br/>2</p></th>
  <th><p><br/>3</p></th>
  <th><p><br/>4</p></th>
  <th><p><br/>5</p></th>
  <th><p><br/>6</p></th>
  <th><p><br/>7</p></th>
  <th><p><br/>8</p></th>
  <th><p><br/>9</p></th>
  <th><p>2<br/>0</p></th>
  <th><p><br/>1</p></th>
  <th><p><br/>2</p></th>
  <th><p><br/>3</p></th>
  <th><p><br/>4</p></th>
  <th><p><br/>5</p></th>
  <th><p><br/>6</p></th>
  <th><p><br/>7</p></th>
  <th><p><br/>8</p></th>
  <th><p><br/>9</p></th>
  <th><p>3<br/>0</p></th>
  <th><p><br/>1</p></th>
 </tr>
 <tr>
  <td colspan="32">
  <p align="center">EFSX_Datum</p>
  </td>
 </tr>
 <tr>
  <td colspan="32">
  <p align="center">...</p>
  </td>
 </tr>
 <tr>
  <td colspan="16">
  <p align="center">BlobType</p>
  </td>
  <td colspan="16">
  <p align="center">BlobFlags</p>
  </td>
 </tr>
 <tr>
  <td colspan="32">
  <p align="center">Blob_Data
  (variable)</p>
  </td>
 </tr>
 <tr>
  <td colspan="32">
  <p align="center">...</p>
  </td>
 </tr>
</tbody></table><p><b>EFSX_Datum (8 bytes): </b>MUST be formatted as
specified in section <a href="1d2fa232-d557-43fe-95e3-2d4ced7f7934" data-linktype="relative-path">2.2.2.2.2</a>.
The datum Type MUST be EFSX_TYPE_BLOB (0x0001). The datum <b>Flags</b> MUST NOT
include 0x0002.</p><p><b>BlobType (2 bytes): </b>The type of the blob,
which provides a hint to the format of the <b>Blob Data</b>. It MUST be a
16-bit unsigned integer in little-endian format.</p><dl>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Value</p>
   </th>
   <th>
   <p>Meaning</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>
  <p>0x0000</p>
  </td>
  <td>
  <p>The blob has no special formatting.</p>
  </td>
 </tr><tr>
  <td>
  <p>0x0001</p>
  </td>
  <td>
  <p>The blob contains a public key formatted as a
  BCRYPT_PUBLIC_KEY_BLOB.</p>
  </td>
 </tr><tr>
  <td>
  <p>0x0002</p>
  </td>
  <td>
  <p>The blob contains a SHA-1 hash of a DER-encoded form
  of a certificate.</p>
  </td>
 </tr><tr>
  <td>
  <p>0x0003</p>
  </td>
  <td>
  <p>The blob contains the encrypted form of an Encrypted
  FEK structure, as defined in section <a href="00933615-c9cf-4d51-9d9a-bb3fb33a3560" data-linktype="relative-path">2.2.2.1.5</a>. The contents
  of the key can be either the FEK or the FMK (see section <a href="8593a473-b726-4a19-9291-b8669b535304" data-linktype="relative-path">2.2.2.2.5</a><span>)</span>.</p>
  </td>
 </tr><tr>
  <td>
  <p>0x0004</p>
  </td>
  <td>
  <p>The blob contains key material wrapped with an AES-256
  key wrapping key, as defined by <a href="https://go.microsoft.com/fwlink/?LinkId=131784" data-linktype="external">[RFC3394]</a>.</p>
  </td>
 </tr><tr>
  <td>
  <p>0x0005</p>
  </td>
  <td>
  <p>The blob contains key material encrypted by a DPAPI-NG
  provider on the endpoint. This BlobType MUST only be used when EFS_VERSION is
  5.<a id="Appendix_A_Target_17"></a><a aria-label="Product behavior note 17" href="cecd911d-7105-45cc-a7c8-348335d6f03f#Appendix_A_17" data-linktype="relative-path">&lt;17&gt;</a></p>
  </td>
 </tr></tbody></table>
</dd></dl><p><b>BlobFlags (2 bytes): </b>Reserved, MUST be 0x0000.</p><p><b>Blob_Data (variable): </b>Contains opaque,
variable-length data. The <b>Blob Data</b> MUST be entirely contained within
the Blob Datum.</p></div>