2.2.3.1 Marshaled Stream

 A Marshaled Stream (including the EFSRPC Metadata stream) MUST be formatted as follows.

0	1	2	3	4	5	6	7	8	9	1 0	1	2	3	4	5	6	7	8	9	2 0	1	2	3	4	5	6	7	8	9	3 0	1
Length
0x4e								0x00								0x54								0x00
0x46								0x00								0x53								0x00
Flag
Reserved
...
Name Length
Stream Name (variable)
...
Stream Data Segment 1 (variable)
...
Stream Data Segment n (variable)
...

Length (4 bytes): The length, in bytes, of this stream header from the start of this field to the end of the Stream Name field. It MUST be a 32-bit unsigned integer in little-endian format.

Flag (4 bytes):  This MUST be a 32-bit unsigned integer in little-endian format. It MUST be set to 0x00000000 if the stream data is encrypted with the FEK. Otherwise, it MUST be set to 0x00000001. It MUST always be set to zero in the case of the EFSRPC Metadata stream, and ignored by the server in that case.

Value	Meaning
0x00000000	FEK encryption present
0x00000001	FEK encryption not present

Reserved (8 bytes): This field MUST be set to zero and ignored.

Name Length (4 bytes):  The length, in bytes, of the Stream Name field. It MUST be a 32-bit unsigned integer in little-endian format. This field MUST be set to 0x00000002 for the EFSRPC Metadata stream.

Stream Name (variable):  The name of the stream. This is set to either a null-terminated Unicode string in UTF-16 encoding, or an integer value stored in binary form. For the EFSRPC Metadata stream, this is always set to 0x1910.

Value	Meaning
0x1910	EFSRPC Metadata stream

Stream Data Segment 1 ... n: These segments MUST contain the contents of the stream as well as some metadata for reassembling the segments. For encrypted streams, these segments MUST also contain some metadata to aid in decryption. They MUST be formatted as specified in section 2.2.3.2.