[Introduction] [Address.dat/Address.aba] [Datebook.dat/Datebook.dba] [Memopad.dat/Memopad.mpa]
[Todo.dat/Todo.tda] [Not So FAQ's] [Home]

Palm Desktop Software USERS.DAT File Structure

Reader, Dave Cantor, contributed the following observations about the users.dat file format. Thanks Dave!

On your page http://www.notsofaqs.com/users_dat.php, you invite comments for corrections and additions.

Well, I've discovered a few things about the format of USERS.DAT that Palm desktop software uses.

My purpose for sending this information is to share what I've learned. I hope you'll incorporate this into your web page.

I've resolved the problem that there sometimes are a few bytes lagging between the end of a user's data and the beginning of the next one ("Note: Any other value is an unknown value, you should continue to read shorts from the record until you encounter one of the above values or EOF to indicate the end of record for this user.")

There is a short integer with the count of permanent (or "default") conduit entries and another short integer with the count of temporary conduit entries for each user. These words are identified on your web page as "Unknown Short 2*Byte Unknown purpose. If you discover its purpose, please let me know."

To further complicate things, the 0x8001 and 0x8003 entries are not item end marks; instead they begin user and conduit entries respectively.

Also the conduit entry's length does NOT vary with the number of users. I've tested with USERS.DAT files with 1, 2, 3, 4, and 5 users, and the conduit entries are always the same length. The apparent varying length is because we didn't understand that there is a 2-byte (short) count of temporary entries following the permanent entries and preceding the temporaries.

The file structure is

  1. A 2-byte count of users followed by
  2. that many user entries.

The first user entry begins with its class name entry (indicated by 0xFFFF) and the rest begin with 0x8001. As you will see, using counts within the user entry will bring us to the 0x8001 mark for the next entry, or the end of file.

The words before the class entry are as you describe, but the item immediately after the password is a 2-byte count of default conduit entries for this user. That is immediately followed by conduit entries, each BEGINNING with 0x8003, except the very first one begins with its class name entry (indicated by 0xFFFF) instead.

Each conduit entry consists of a 4-byte owner name (or number) as described, but following that are two short (2-byte) integers. The first is the value as you've described (but I've never seen a value 4). The second word is unknown. It looks like it's always zero.

Following the counted series of default entries is a 2-byte count of temporary entries. This word is often zero, but the count word is present even if there are no actual entries.

I believe that's the whole thing.

I've attached a dump of a USERS.DAT file that I have here, and a report of the values from a program I wrote to decode it. This file has 3 users: one with both default and temporary conduit actions, one with no conduit actions whatsoever, and one with just two default conduit actions.

I haven't figured out what the unknown 2-byte value is that appears just before the password in the user entry, nor the second 2-byte value in the conduit entry (maybe the conduit entry is a single 4-byte value).

I hope this helps. If you need clarification, please write.

Sincerely,
Dave Cantor
Groton, CT
June 2009

-------------- Enclosure number 1 ----------------

 Volume in drive C is IRVING-C      Serial number is 28aa:b2d9
 Directory of  C:\Program Files\Palm\users.dat

06-29-2009  10:01             257  users.dat 
     257 bytes in 1 file and 0 dirs    4,096 bytes allocated
     8,384,851,968 bytes free

  users.dat
0000 0000 03 00 ff ff 01 00 05 00  43 55 73 65 72 69 1d 00  ?.  ?.?.CUseri?.
0000 0010 00 07 44 61 76 65 20 43  2e 02 43 44 01 00 00 00  .•Dave C.?CD?...
0000 0020 00 00 07 00 ff ff 01 00  13 00 43 55 73 65 72 53  ..•.  ?.?.CUserS
0000 0030 79 6e 63 50 72 65 66 65  72 65 6e 63 65 64 61 70  yncPreferencedap
0000 0040 56 03 00 00 00 03 80 6f  74 6f 46 03 00 00 00 03  V?...?ÇotoF?...?
0000 0050 80 4f 52 50 4c 00 00 00  00 03 80 72 6b 6c 50 01  ÇORPL....?ÇrklP?
0000 0060 00 00 00 03 80 34 48 73  54 03 00 00 00 03 80 73  ...?Ç4HsT?...?Çs
0000 0070 70 78 65 00 00 00 00 03  80 6c 69 61 6d 03 00 00  pxe....?Çliam?..
0000 0080 00 04 00 03 80 64 61 70  56 03 00 00 00 03 80 74  .?.?ÇdapV?...?Çt
0000 0090 73 6e 49 03 00 00 00 03  80 6f 74 6f 46 03 00 00  snI?...?ÇotoF?..
0000 00a0 00 03 80 43 4d 69 50 03  00 00 00 01 80 32 5f 00  .?ÇCMiP?...?Ç2_.
0000 00b0 00 06 50 72 6f 6e 74 6f  06 50 72 6f 6e 74 6f 01  .?Pronto?Pronto?
0000 00c0 00 00 00 00 00 00 00 00  00 01 80 aa 51 00 00 10  .........?ǬQ..?
0000 00d0 50 61 6c 6d 20 4f 53 20  45 6d 75 6c 61 74 6f 72  Palm OS Emulator
0000 00e0 02 4f 53 01 00 00 00 00  00 02 00 03 80 43 4d 69  ?OS?.....?.?ÇCMi
0000 00f0 50 03 00 00 00 03 80 4f  52 50 4c 01 00 00 00 00  P?...?ÇORPL?....
0000 0100 00                                                .



Running C:\work\listusersdat.bat at 29-Jun-2009 20:13:51 EDT

Using file "C:\Program Files\Palm\users.dat", last modification 2009-06-29,10:01:27.734.
Number of users: 3
User 1: 00001D69  'Dave C.'   "C:\Program Files\Palm\CD"
      Hotsync flag: 1     Password length:  0
  Permanent Hotsync actions
   1. Vpad  No action
   2. Foto  No action
   3. LPRO  Synchronize
   4. Plkr  PC overwrites handheld
   5. TsH4  No action
   6. exps  Synchronize
   7. mail  No action
  Temporary Hotsync actions
   1. Vpad  No action
   2. Inst  No action
   3. Foto  No action
   4. PiMC  No action
User 2: 00005F32  'Pronto'   "C:\Program Files\Palm\Pronto"
      Hotsync flag: 1     Password length:  0
User 3: 000051AA  'Palm OS Emulator'   "C:\Program Files\Palm\OS"
      Hotsync flag: 1     Password length:  0
  Permanent Hotsync actions
   1. PiMC  No action
   2. LPRO  PC overwrites handheld

Users.Dat

Field Name Type Size Comments
User Count Short 2*Byte The count of users
Class Flag Short 2*Byte 0xFFFF value to indicate a class entry follows
Class entry Class-Entry   CUser class name
User entry User-Entry   occurs user count number of times

User-Entry

Field Name Type Size Comments
Hotsync ID Long 4*Byte Unique hotsync id for this user. Values less than 256 are reserved and indicate a user profile record
NLength Char 1*Byte Length of user Long Name
Long Name Char String User Long Name of NLength
Dlength Char 1*Byte Length of user directory name
Dir Name Char String User directory name of DLength
Active Short 2*Byte value 0x0001 indicates an active user that has hotsynced with this PC before.
PWLength Short 2*Byte Length of user password, if any.
Unknown Short 2*Byte Unknown purpose. If you discover its purpose, please let me know.
Password Char String A 32 character encoded string that represents the user password.
Important: This field is present only if the PWLength is non-zero.
Unknown Short 2*Byte Unknown purpose. If you discover its purpose, please let me know.
Variable Data Flag Short 2*Byte 0xFFFF value to indicate a class entry follows. If one does, it will be immediately followed by Conduit Entries for the Permanent Sync settings.
0x8001 value to indicate no more data for this user.
0x8003 value to indicate Conduit Entries follow for this users Temporary Sync settings.
Note: Any other value is an unknown value, you should continue to read shorts from the record until you encounter one of the above values or EOF to indicate the end of record for this user.
Variable-Data Variable-Data   See Variable Data Flag field for an explanation.

Class-Entry

Field Name Type Size Comments
Constant Short 2*Byte Constant 1
Length Short 2*Byte Length of Class Name
Class Name Char Byte Class name of length specified.

Variable-Data

Field Name Type Size Comments
Class entry Class-Entry   CUserSyncPreference class name Present only if Variable Flag is 0xFFFF. Note that when this field is present, it will always be immediately followed by Conduit-Entries representing the Permanent Sync Settings for this machine.
Conduit entry Conduit-Entry   Conduit Settings, occurs a variable number of times.

Conduit-Entry

Field Name Type Size Comments
Creator ID Char 4*Byte The reversed 4 byte creator ID associated with the conduit.
Note: I have observed entries here with non-character values like 0x00000001 and 0x00000002. These may represent custom settings associated with certain conduits, but I am not sure.
Settings Char ByteArray Conduit Settings, occurs a variable number of times (perhaps related to the number of users). The byte array terminates with a 0x80 byte. The byte prior to the terminating byte indicates whether or not more entries follow (0x01 = no more entries, 0x03 = more entries).
The ByteArray may represent the individual user settings for this conduit, where user 0 in the users.dat file is index 0 in the ByteArray and the value is the setting for the conduit, e.g.,
0x00 = Synchronize
0x01 = Overwrite PC to Handheld
0x02 = Overwrite Handheld to PC
0x03 = Do Nothing
0x04 = Custom


Last updated: June 30, 2009