=DB=
This is very basic description and is likely to change...
Since the database is just a cache of the NTFS mft with some volume information, it can be re-built from scratch easily.

BZIP compression can be applied.
I usually see a total 11:1 compression ratio.
After BZIP decompression it should look something like:

{|
! Offset
! Size
! Description
|-
| 0x00000000
| DWORD
| 0x42445A45 or EZDB or (0x455A4442 or BDZE for byte swapped)
|-
| 0x00000004
| DWORD
| 0x01060006 or version 0xXXYYZZZZ x.y.z (major.minor.revision)
|-
| 0x00000008
| DWORD
| flags: 0x00000002 exclude hidden files and folders. 0x00000004 exclude system files and folders.
|-
| 0x0000000C
| DWORD
| folder count
|-
| 0x00000010
| DWORD
| file count
|-
| 0x00000014
| DWORD
| folder decode size
|-
| 0x00000018
| DWORD
| file decode size
|}

Followed immediately by the monitoring status for each volume.

There are 26 of the following structures, one for each drive:

{|
! Offset
! Size
! Description
|-
| 0x00000000
| BYTE
| included: 0x00 there is no data for this volume so start reading the next volume. 0x01 continue reading the information for this volume.
|-
| 0x00000001
| DWORD
| serial number
|-
| 0x00000005
| QWORD
| USN Journal ID
|-
| 0x0000000D
| QWORD
| Next USN
|}

Followed immediately by the exclude list count:

{|
| 0x00000000
| DWORD
| number of exclude items.
|}

Followed immediately by the exclude list:
Use the exclude list count from above to determine how many exclude items there are..

{|
! Offset
! Size
! Description
|-
| 0x00000000
| BYTE
| exclude type
|-
| 0x00000001
| DWORD
| length of the exclude string
|-
| 0x00000005
| length of the exclude string
| exclude string
|}

Followed immediately by the sorted folders:
We know the number of folders from above.

{|
! Offset
! Size
! Description
|-
| 0x00000000
| BYTE
| drive this folder belongs too.
|-
| 0x00000001
| QWORD
| FRN
|-
| 0x00000005
| DWORD
| Parent folder offset, or 0xFFFFFFFF if root.
|-
| 0x00000009
| DWORD
| FRN offset
|-
| 0x0000000D
| BYTE
| code length, if 0 it is the same name, skip to the next folder after adding the same name.
|-
| 0x0000000E
| BYTE
| code offset
|-
| 0x0000000F
| code length
| code
|}

Followed immediately by the sorted files:
We know the number of files from above.

{|
! Offset
! Size
! Description
|-
| 0x00000000
| DWORD
| Parent folder offset
|-
| 0x00000004
| BYTE
| code length, if 0 it is the same name, skip to the next file after adding the same name.
|-
| 0x00000005
| BYTE
| code offset
|-
| 0x00000006
| code length
| code
|}
