Palm Desktop Software USERS.DAT File Structure

• These formats apply to the Windows version of the Palm Desktop software.
• The information presented here may or may not be accurate, the author makes no representation as to the accuracy of any information supplied.
• Palm does not recommend that you program to the structure of the desktop data files. They have publicly stated that these files are subject to change at any time. Use this information at your own risk!
• Warning: This file format was developed by studying the actual contents of users.dat and making educated guesses regarding the structure and meaning of the contents. Although the author experimented with various conduit settings and user counts, it is highly probable that this format is incomplete and may contain errors.

Reader, Dave Cantor, contributed the following observations about the users.dat file format. Thanks Dave!

On your page http://www.notsofaqs.com/users_dat.php, you invite comments for corrections and additions.

Well, I've discovered a few things about the format of USERS.DAT that Palm desktop software uses.

My purpose for sending this information is to share what I've learned. I hope you'll incorporate this into your web page.

I've resolved the problem that there sometimes are a few bytes lagging between the end of a user's data and the beginning of the next one ("Note: Any other value is an unknown value, you should continue to read shorts from the record until you encounter one of the above values or EOF to indicate the end of record for this user.")

There is a short integer with the count of permanent (or "default") conduit entries and another short integer with the count of temporary conduit entries for each user. These words are identified on your web page as "Unknown Short 2*Byte Unknown purpose. If you discover its purpose, please let me know."

To further complicate things, the 0x8001 and 0x8003 entries are not item end marks; instead they begin user and conduit entries respectively.

Also the conduit entry's length does NOT vary with the number of users. I've tested with USERS.DAT files with 1, 2, 3, 4, and 5 users, and the conduit entries are always the same length. The apparent varying length is because we didn't understand that there is a 2-byte (short) count of temporary entries following the permanent entries and preceding the temporaries.

The file structure is

1. A 2-byte count of users followed by
2. that many user entries.

The first user entry begins with its class name entry (indicated by 0xFFFF) and the rest begin with 0x8001. As you will see, using counts within the user entry will bring us to the 0x8001 mark for the next entry, or the end of file.

The words before the class entry are as you describe, but the item immediately after the password is a 2-byte count of default conduit entries for this user. That is immediately followed by conduit entries, each BEGINNING with 0x8003, except the very first one begins with its class name entry (indicated by 0xFFFF) instead.

Each conduit entry consists of a 4-byte owner name (or number) as described, but following that are two short (2-byte) integers. The first is the value as you've described (but I've never seen a value 4). The second word is unknown. It looks like it's always zero.

Following the counted series of default entries is a 2-byte count of temporary entries. This word is often zero, but the count word is present even if there are no actual entries.

I believe that's the whole thing.

I've attached a dump of a USERS.DAT file that I have here, and a report of the values from a program I wrote to decode it. This file has 3 users: one with both default and temporary conduit actions, one with no conduit actions whatsoever, and one with just two default conduit actions.

I haven't figured out what the unknown 2-byte value is that appears just before the password in the user entry, nor the second 2-byte value in the conduit entry (maybe the conduit entry is a single 4-byte value).

I hope this helps. If you need clarification, please write.

Sincerely,
Dave Cantor
Groton, CT
June 2009

-------------- Enclosure number 1 ----------------

 Volume in drive C is IRVING-C      Serial number is 28aa:b2d9
 Directory of  C:\Program Files\Palm\users.dat

06-29-2009  10:01             257  users.dat 
     257 bytes in 1 file and 0 dirs    4,096 bytes allocated
     8,384,851,968 bytes free

  users.dat
0000 0000 03 00 ff ff 01 00 05 00  43 55 73 65 72 69 1d 00  ?.  ?.?.CUseri?.
0000 0010 00 07 44 61 76 65 20 43  2e 02 43 44 01 00 00 00  .•Dave C.?CD?...
0000 0020 00 00 07 00 ff ff 01 00  13 00 43 55 73 65 72 53  ..•.  ?.?.CUserS
0000 0030 79 6e 63 50 72 65 66 65  72 65 6e 63 65 64 61 70  yncPreferencedap
0000 0040 56 03 00 00 00 03 80 6f  74 6f 46 03 00 00 00 03  V?...?ÇotoF?...?
0000 0050 80 4f 52 50 4c 00 00 00  00 03 80 72 6b 6c 50 01  ÇORPL....?ÇrklP?
0000 0060 00 00 00 03 80 34 48 73  54 03 00 00 00 03 80 73  ...?Ç4HsT?...?Çs
0000 0070 70 78 65 00 00 00 00 03  80 6c 69 61 6d 03 00 00  pxe....?Çliam?..
0000 0080 00 04 00 03 80 64 61 70  56 03 00 00 00 03 80 74  .?.?ÇdapV?...?Çt
0000 0090 73 6e 49 03 00 00 00 03  80 6f 74 6f 46 03 00 00  snI?...?ÇotoF?..
0000 00a0 00 03 80 43 4d 69 50 03  00 00 00 01 80 32 5f 00  .?ÇCMiP?...?Ç2_.
0000 00b0 00 06 50 72 6f 6e 74 6f  06 50 72 6f 6e 74 6f 01  .?Pronto?Pronto?
0000 00c0 00 00 00 00 00 00 00 00  00 01 80 aa 51 00 00 10  .........?ǬQ..?
0000 00d0 50 61 6c 6d 20 4f 53 20  45 6d 75 6c 61 74 6f 72  Palm OS Emulator
0000 00e0 02 4f 53 01 00 00 00 00  00 02 00 03 80 43 4d 69  ?OS?.....?.?ÇCMi
0000 00f0 50 03 00 00 00 03 80 4f  52 50 4c 01 00 00 00 00  P?...?ÇORPL?....
0000 0100 00                                                .



Running C:\work\listusersdat.bat at 29-Jun-2009 20:13:51 EDT

Using file "C:\Program Files\Palm\users.dat", last modification 2009-06-29,10:01:27.734.
Number of users: 3
User 1: 00001D69  'Dave C.'   "C:\Program Files\Palm\CD"
      Hotsync flag: 1     Password length:  0
  Permanent Hotsync actions
   1. Vpad  No action
   2. Foto  No action
   3. LPRO  Synchronize
   4. Plkr  PC overwrites handheld
   5. TsH4  No action
   6. exps  Synchronize
   7. mail  No action
  Temporary Hotsync actions
   1. Vpad  No action
   2. Inst  No action
   3. Foto  No action
   4. PiMC  No action
User 2: 00005F32  'Pronto'   "C:\Program Files\Palm\Pronto"
      Hotsync flag: 1     Password length:  0
User 3: 000051AA  'Palm OS Emulator'   "C:\Program Files\Palm\OS"
      Hotsync flag: 1     Password length:  0
  Permanent Hotsync actions
   1. PiMC  No action
   2. LPRO  PC overwrites handheld

Users.Dat

Field Name	Type	Size	Comments
User Count	Short	2*Byte	The count of users
Class Flag	Short	2*Byte	0xFFFF value to indicate a class entry follows
Class entry	Class-Entry		CUser class name
User entry	User-Entry		occurs user count number of times

User-Entry

Field Name	Type	Size	Comments
Hotsync ID	Long	4*Byte	Unique hotsync id for this user. Values less than 256 are reserved and indicate a user profile record
NLength	Char	1*Byte	Length of user Long Name
Long Name	Char	String	User Long Name of NLength
Dlength	Char	1*Byte	Length of user directory name
Dir Name	Char	String	User directory name of DLength
Active	Short	2*Byte	value 0x0001 indicates an active user that has hotsynced with this PC before.
PWLength	Short	2*Byte	Length of user password, if any.
Unknown	Short	2*Byte	Unknown purpose. If you discover its purpose, please let me know.
Password	Char	String	A 32 character encoded string that represents the user password. Important: This field is present only if the PWLength is non-zero.
Unknown	Short	2*Byte	Unknown purpose. If you discover its purpose, please let me know.
Variable Data Flag	Short	2*Byte	0xFFFF value to indicate a class entry follows. If one does, it will be immediately followed by Conduit Entries for the Permanent Sync settings. 0x8001 value to indicate no more data for this user. 0x8003 value to indicate Conduit Entries follow for this users Temporary Sync settings. Note: Any other value is an unknown value, you should continue to read shorts from the record until you encounter one of the above values or EOF to indicate the end of record for this user.
Variable-Data	Variable-Data		See Variable Data Flag field for an explanation.

Class-Entry

Field Name	Type	Size	Comments
Constant	Short	2*Byte	Constant 1
Length	Short	2*Byte	Length of Class Name
Class Name	Char	Byte	Class name of length specified.

Variable-Data

Field Name	Type	Size	Comments
Class entry	Class-Entry		CUserSyncPreference class name Present only if Variable Flag is 0xFFFF. Note that when this field is present, it will always be immediately followed by Conduit-Entries representing the Permanent Sync Settings for this machine.
Conduit entry	Conduit-Entry		Conduit Settings, occurs a variable number of times.

Conduit-Entry

Field Name	Type	Size	Comments
Creator ID	Char	4*Byte	The reversed 4 byte creator ID associated with the conduit. Note: I have observed entries here with non-character values like 0x00000001 and 0x00000002. These may represent custom settings associated with certain conduits, but I am not sure.
Settings	Char	ByteArray	Conduit Settings, occurs a variable number of times (perhaps related to the number of users). The byte array terminates with a 0x80 byte. The byte prior to the terminating byte indicates whether or not more entries follow (0x01 = no more entries, 0x03 = more entries). The ByteArray may represent the individual user settings for this conduit, where user 0 in the users.dat file is index 0 in the ByteArray and the value is the setting for the conduit, e.g., 0x00 = Synchronize 0x01 = Overwrite PC to Handheld 0x02 = Overwrite Handheld to PC 0x03 = Do Nothing 0x04 = Custom

---

Last updated: June 30, 2009

copyright 2007-2017 Scott W. Leighton