ONE File Documentation

Summary

A Microsoft OneNote Document is one section of a OneNote notebook: the pages of typed text, images, ink and attachments behind a single tab. The .one file is a binary revision-store container defined by [MS-ONESTORE], with the MIME type application/onenote. It begins with a 16-byte file-type GUID, not readable text, so you open it with OneNote rather than a text editor. A whole notebook is many .one sections plus a .onetoc2 table of contents.

Technical details

FeatureValue
Full nameMicrosoft OneNote Document (notebook section)
File extension.one
MIME typeapplication/onenote
Format typeRevision-store binary container
Specification[MS-ONESTORE] (published open specification)
DeveloperMicrosoft
IntroducedOneNote 2003; current binary since OneNote 2010
Open standardPartial (Microsoft-published spec, proprietary product)
Byte orderLittle-endian
File-format GUID{109ADD3F-911B-49F5-A5D0-1791EDC8AED8}
Section file-type GUID{7B5C52E4-D88C-4DA7-AEB1-5378D02996D3}
Magic number (hex)E4 52 5C 7B 8C D8 A7 4D AE B1 53 78 D0 29 96 D3 at offset 0
Core structuresHeader, object spaces, objects, property sets, file node lists
Sync designTransaction log + revisions for incremental multi-device sync
Content heldText, images, ink, audio/video, tables, file attachments
Table of contentsSibling .onetoc2 file orders sections
Packaged notebook.onepkg (archive of sections + TOC)
Related extensions.onepkg, .onetoc2, .onenote
Specification URLlearn.microsoft.com/openspecs/office_file_formats/ms-onestore
File signature (magic bytes)
E4 52 5C 7B 8C D8 A7 4D AE B1 53 78 D0 29 96 D3

The first 16 bytes are the guidFileType GUID, and for a OneNote section they encode {7B5C52E4-D88C-4DA7-AEB1-5378D02996D3}. A GUID is not stored as its printed text: the first three groups are little-endian, so 7B5C52E4 appears on disk as E4 52 5C 7B, D88C as 8C D8, and 4DA7 as A7 4D, while the final eight bytes stay in order. A short way after the header sits a second constant GUID, guidFileFormat = {109ADD3F-911B-49F5-A5D0-1791EDC8AED8}, which marks every OneNote revision-store file regardless of whether it is a section or a .onetoc2.

What is a ONE file?

A Microsoft OneNote Document holds one section of a OneNote notebook: the equivalent of a single tab in a binder, containing one or more pages of free-form notes. Those pages can mix typed text placed anywhere on the canvas, images, handwritten ink, audio and video recordings, tables, hyperlinks and attached files. OneNote first shipped in 2003, and the current binary form of the .one file dates from OneNote 2010, when Microsoft published the format as the [MS-ONESTORE] specification.

A notebook is not a single file. OneNote stores it as a folder: each section is its own .one file, and a .onetoc2 file records the notebook’s table of contents (which sections exist and their order). A whole notebook bundled for sharing is a single .onepkg package, essentially an archive of the section files plus their TOC. So when you meet a loose .one, you are looking at the content of one tab, and it may expect its sibling .onetoc2 to sit in context.

The revision store: why ONE is not a flat document

[MS-ONESTORE] calls a .one a revision store file, and that name explains the whole design. Unlike a Word document that is written out whole, a OneNote section is built to be edited a little at a time on several devices and merged. Rather than rewriting the file on every keystroke, OneNote appends changes and keeps older revisions, so two devices that edited the same page offline can later reconcile without losing either edit. The format is optimised for incremental, asynchronous sync, not for a human reading the bytes.

Concretely, the file is a collection of cross-referenced structures: a header, one or more object spaces (each roughly a page or page-group), objects that carry the actual content, property sets that attach attributes to objects, and a transaction log that records committed changes so a partially written file can still be recovered. Content is not stored in reading order; it is stored as objects linked by references, and the reader walks those references to reconstruct a page.

The header, guidFileType and guidFileFormat

Every revision-store file begins with a fixed Header structure, and its first fields are two GUIDs. guidFileType (16 bytes at offset 0) says what kind of file this is; for a section it is {7B5C52E4-D88C-4DA7-AEB1-5378D02996D3}, while a .onetoc2 uses a different value. guidFile then gives this specific file its own identity, and guidFileFormat is a constant, {109ADD3F-911B-49F5-A5D0-1791EDC8AED8}, present in every OneNote revision-store file to mark the format itself.

Header (start of file)
  guidFileType     : GUID   which kind of file (section vs toc)
  guidFile         : GUID   unique identity of this file
  guidLegacyFileVersion
  guidFileFormat   : GUID   {109ADD3F-...} constant "this is OneNote"
  ...
  fcrTransactionLog        : reference to first transaction-log fragment
  fcrHashedChunkList       : reference to the hashed chunk list
  fcrFreeChunkList         : reference to free space
  ...

The GUIDs are stored in the usual Windows on-disk layout: the first three components are little-endian, the last two are byte-order preserved. That is why the printed 7B5C52E4 lands in the file as the bytes E4 52 5C 7B. The header also holds a set of file chunk references (the fcr... fields) that point at the transaction log, the free-chunk list and other bookkeeping regions, so a parser can find the machinery it needs without scanning the whole file.

File node lists, chunks and object spaces

Above the raw bytes, [MS-ONESTORE] organises data into file node lists: linked lists of file node records, each a small typed entry that either carries data inline or points to a chunk elsewhere in the file. File nodes are how the format expresses “here is an object space”, “here is a revision”, “here is an object’s data” and “this reference continues in another fragment”. Because the lists are fragmented and chained, new data can be appended to the end of the file and stitched into the logical structure by adding references, which is what makes append-only editing possible.

An object space groups the objects for a logical unit such as a page. Within it, revisions capture successive states, and each object gathers its content through a property set: a list of property IDs and values that describe, for instance, a text run, an image, an ink stroke, or the position and size of a note container on the page. Reconstructing a page means selecting the current revision of its object space, reading its objects, and resolving each object’s properties, following file-node references across fragments as needed.

Section, table of contents and package

Three OneNote extensions travel together and are easy to confuse. A .one is a single section (one tab of content). A .onetoc2 is the table of contents that lists the sections in a notebook and their order; it uses the same revision-store format but a different guidFileType. A .onepkg is a OneNote Package, a bundle of the .one sections and their .onetoc2 used to email or move an entire notebook as one file; OneNote unpacks it back into loose sections. A bare section can be opened on its own, but some sections expect to be seen inside a notebook, which is why dropping the .one into a notebook folder or opening the .onepkg sometimes succeeds where the loose file stalls.

Reading a ONE without OneNote

Because the content is stored as linked objects and property sets in a binary revision store, no text editor will show your notes; you would see the header GUIDs and chunk data. The dependable readers are OneNote itself (now a free desktop app), OneNote for the web when the notebook lives on OneDrive, and free OneNote viewers built for recovery. The publication of [MS-ONESTORE] also made independent parsers possible; open-source projects exist that walk the object spaces and export a section’s pages, which is how some third-party viewers read a .one without any Microsoft code.

For sharing or archiving, OneNote’s File → Export writes the section out to PDF (a fixed copy) or DOCX (an approximated, editable document, since OneNote’s free-form page has no fixed reading flow). The mobile and Mac apps open notebooks through OneDrive rather than loose local files, so a bare .one from a Windows backup usually has to be added to a synced notebook before those apps will show it.

FAQ

What is the difference between a ONE and a ONEPKG?

A .one is a single notebook section. A .onepkg is a whole packaged notebook, an archive of all its sections plus the .onetoc2 table of contents, used to move or share a notebook as one file. OneNote unpacks a .onepkg back into individual .one sections.

Why does a ONE file start with a GUID instead of text?

The format is a binary revision store, and its header identifies the file type with a 16-byte guidFileType so any reader can confirm it is a OneNote section before parsing further. A constant guidFileFormat nearby marks it as a OneNote revision-store file in general.

Why won’t my loose section open on its own?

Sections sometimes expect to belong to a notebook. Put the .one in a OneDrive-synced notebook folder, or open the notebook’s .onepkg package, so OneNote sees the section alongside its .onetoc2 table of contents.

References