<div class="content" name="EFSRPC_METADATA_V1" uuid="625335e5-a423-4d1c-be51-c696c32aa2eb"><table>
 <tbody><tr>
  <th><p><br/>0</p></th>
  <th><p><br/>1</p></th>
  <th><p><br/>2</p></th>
  <th><p><br/>3</p></th>
  <th><p><br/>4</p></th>
  <th><p><br/>5</p></th>
  <th><p><br/>6</p></th>
  <th><p><br/>7</p></th>
  <th><p><br/>8</p></th>
  <th><p><br/>9</p></th>
  <th><p>1<br/>0</p></th>
  <th><p><br/>1</p></th>
  <th><p><br/>2</p></th>
  <th><p><br/>3</p></th>
  <th><p><br/>4</p></th>
  <th><p><br/>5</p></th>
  <th><p><br/>6</p></th>
  <th><p><br/>7</p></th>
  <th><p><br/>8</p></th>
  <th><p><br/>9</p></th>
  <th><p>2<br/>0</p></th>
  <th><p><br/>1</p></th>
  <th><p><br/>2</p></th>
  <th><p><br/>3</p></th>
  <th><p><br/>4</p></th>
  <th><p><br/>5</p></th>
  <th><p><br/>6</p></th>
  <th><p><br/>7</p></th>
  <th><p><br/>8</p></th>
  <th><p><br/>9</p></th>
  <th><p>3<br/>0</p></th>
  <th><p><br/>1</p></th>
 </tr>
 <tr>
  <td colspan="32">Length</td>
 </tr>
 <tr>
  <td colspan="32">Reserved1</td>
 </tr>
 <tr>
  <td colspan="32">EFS_Version</td>
 </tr>
 <tr>
  <td colspan="32">Reserved2</td>
 </tr>
 <tr>
  <td colspan="32">EFS_ID (16 bytes)</td>
 </tr>
 <tr>
  <td colspan="32">...</td>
 </tr>
 <tr>
  <td colspan="32">...</td>
 </tr>
 <tr>
  <td colspan="32">...</td>
 </tr>
 <tr>
  <td colspan="32">EFS_Hash (16 bytes)</td>
 </tr>
 <tr>
  <td colspan="32">...</td>
 </tr>
 <tr>
  <td colspan="32">...</td>
 </tr>
 <tr>
  <td colspan="32">...</td>
 </tr>
 <tr>
  <td colspan="32">Reserved3 (16 bytes)</td>
 </tr>
 <tr>
  <td colspan="32">...</td>
 </tr>
 <tr>
  <td colspan="32">...</td>
 </tr>
 <tr>
  <td colspan="32">...</td>
 </tr>
 <tr>
  <td colspan="32">DDF_Offset</td>
 </tr>
 <tr>
  <td colspan="32">DRF_Offset</td>
 </tr>
 <tr>
  <td colspan="32">Reserved4</td>
 </tr>
 <tr>
  <td colspan="32">...</td>
 </tr>
 <tr>
  <td colspan="32">...</td>
 </tr>
 <tr>
  <td colspan="32">Data_Fields (variable)</td>
 </tr>
 <tr>
  <td colspan="32">...</td>
 </tr>
</tbody></table><p><b>Length (4 bytes): </b>This field MUST contain a 32-bit
unsigned integer equal to the length, in bytes, of the <a href="3166cf4a-e085-47be-94c6-b69bddf274ff" data-linktype="relative-path">EFSRPC Metadata</a>.<a id="Appendix_A_Target_7"></a><a aria-label="Product behavior note 7" href="cecd911d-7105-45cc-a7c8-348335d6f03f#Appendix_A_7" data-linktype="relative-path">&lt;7&gt;</a></p><p><b>Reserved1 (4 bytes): </b>MUST be set to zero and
ignored upon receipt.</p><p><b>EFS_Version (4 bytes): </b>This field represents
the highest <a href="230807ac-20be-494f-86e3-4c8ac23ea584#gt_3bd30c20-9517-4030-a48c-380362e209a1" data-linktype="relative-path">EFS</a> version
supported by the implementation that created this metadata. It MUST be a 32-bit
unsigned integer in little-endian format. It MUST be set to one of the
following values.</p><dl>
<dd>
<table><thead>
  <tr>
   <th>
   <p>Value</p>
   </th>
   <th>
   <p>Meaning</p>
   </th>
  </tr>
 </thead><tbody><tr>
  <td>Version_1 0x00000001</td>
  <td>The file encryption key (FEK) will be a DESX key, and encrypted with RSA only. The Flags field in all key list entries will be zero.</td>
 </tr><tr>
  <td>Version_2 0x00000002</td>
  <td>The FEK will use DESX, 3DES, or AES-256. The FEK will be encrypted with RSA only. The Flags field in all key list entries will be zero.</td>
 </tr><tr>
  <td>Version_3 0x00000003</td>
  <td>The FEK will use DESX, 3DES, or AES-256. The FEK will be encrypted with either RSA or AES-256.</td>
 </tr></tbody></table>
</dd></dl><p>A server that supports a given version number MUST also
support all lower numbered versions. A server SHOULD support all versions
listed.<a id="Appendix_A_Target_8"></a><a aria-label="Product behavior note 8" href="cecd911d-7105-45cc-a7c8-348335d6f03f#Appendix_A_8" data-linktype="relative-path">&lt;8&gt;</a></p><p><b>Reserved2 (4 bytes): </b>MUST be set to zero and
ignored upon receipt.</p><p><b>EFS_ID (16 bytes): </b>A 16-byte <a href="230807ac-20be-494f-86e3-4c8ac23ea584#gt_f49694cc-c350-462d-ab8e-816f0103c6c1" data-linktype="relative-path">GUID</a> value that MUST be
unique for the computer that created this metadata.</p><p><b>EFS_Hash (16 bytes): </b>This field SHOULD be set
to zero and ignored by the server.<a id="Appendix_A_Target_9"></a><a aria-label="Product behavior note 9" href="cecd911d-7105-45cc-a7c8-348335d6f03f#Appendix_A_9" data-linktype="relative-path">&lt;9&gt;</a></p><p><b>Reserved3 (16 bytes): </b>MUST be set to zero and
ignored upon receipt.</p><p><b>DDF_Offset (4 bytes): </b> This field MUST contain
the offset, in bytes, of the <a href="230807ac-20be-494f-86e3-4c8ac23ea584#gt_1c30c0a6-5251-40d5-9641-748df0618e7c" data-linktype="relative-path">data
decryption field (DDF)</a> key list from the start of the EFSRPC Metadata. It
MUST be a 32-bit unsigned integer in little-endian format. The DDF key list
lies completely within the <b>Data Fields</b> and does not overlap the <a href="230807ac-20be-494f-86e3-4c8ac23ea584#gt_60e31963-34c7-4df0-a133-2ccd656bf425" data-linktype="relative-path">data recovery field (DRF)</a>
key list (if present).</p><p><b>DRF_Offset (4 bytes): </b>This field MUST contain
the offset, in bytes, of the DRF key list from the start of the EFSRPC
Metadata. It MUST be a 32-bit unsigned integer in little-endian format. A zero
value in this field indicates that the DRF key list is absent and no <a href="230807ac-20be-494f-86e3-4c8ac23ea584#gt_c2d1bb54-31a8-4918-a163-39a7851c347a" data-linktype="relative-path">DRAs</a> have been applied to
the <a href="230807ac-20be-494f-86e3-4c8ac23ea584#gt_a04c146a-de3b-4e4b-829f-a9e772f3fe25" data-linktype="relative-path">file</a>. If present,
the DRF key list MUST lie completely within <b>Data Fields</b> and MUST NOT
overlap the DDF key list.</p><p><b>Reserved4 (12 bytes): </b>MUST be set to zero and
ignored upon receipt.</p><p><b>Data_Fields (variable): </b> This field MUST
contain the following two items in any order at the locations indicated by the
respective Offset fields previously listed. Both items MUST conform to the key
list format specified in section <a href="0e9d5482-59c7-4cd3-a439-603f9d154963" data-linktype="relative-path">2.2.2.1.1</a>. The DDF key
list MUST NOT overlap with the DRF key list (if present). There MUST NOT be any
unused areas within this field spanning more than 8 contiguous bytes. Any
unused areas within this field MUST be set to zero bytes and ignored by the
server.</p><dl>
<dd>
<table>
 <tbody><tr>
  <th><p><br/>0</p></th>
  <th><p><br/>1</p></th>
  <th><p><br/>2</p></th>
  <th><p><br/>3</p></th>
  <th><p><br/>4</p></th>
  <th><p><br/>5</p></th>
  <th><p><br/>6</p></th>
  <th><p><br/>7</p></th>
  <th><p><br/>8</p></th>
  <th><p><br/>9</p></th>
  <th><p>1<br/>0</p></th>
  <th><p><br/>1</p></th>
  <th><p><br/>2</p></th>
  <th><p><br/>3</p></th>
  <th><p><br/>4</p></th>
  <th><p><br/>5</p></th>
  <th><p><br/>6</p></th>
  <th><p><br/>7</p></th>
  <th><p><br/>8</p></th>
  <th><p><br/>9</p></th>
  <th><p>2<br/>0</p></th>
  <th><p><br/>1</p></th>
  <th><p><br/>2</p></th>
  <th><p><br/>3</p></th>
  <th><p><br/>4</p></th>
  <th><p><br/>5</p></th>
  <th><p><br/>6</p></th>
  <th><p><br/>7</p></th>
  <th><p><br/>8</p></th>
  <th><p><br/>9</p></th>
  <th><p>3<br/>0</p></th>
  <th><p><br/>1</p></th>
 </tr>
 <tr>
  <td colspan="32">DDF_key_list (variable)</td>
 </tr>
 <tr>
  <td colspan="32">...</td>
 </tr>
 <tr>
  <td colspan="32">DRF_key_list (variable)</td>
 </tr>
 <tr>
  <td colspan="32">...</td>
 </tr>
</tbody></table>
</dd>
<dd>
<p><b>DDF_key_list (variable): </b> This
field MUST contain one or more entries. Each entry consists of the file&#39;s FEK,
encrypted with the <a href="230807ac-20be-494f-86e3-4c8ac23ea584#gt_4cf96ca0-e3a9-4165-8d1a-a21b1397007a" data-linktype="relative-path">public
key</a> of a user authorized to access the file.</p>
</dd>
<dd>
<p><b>DRF_key_list (variable): </b> This
MUST contain one or more entries. Each entry consists of the file’s FEK,
encrypted with the public key of a DRA authorized to access the file. This MUST
only be present if the value in the DRF offset field is nonzero.</p>
</dd></dl></div>