NTFS Documentation: FILE record

Definition

Layout

• The header part

  Offset to the beginning of the FILE record	Length	Description
  0	4	Magic number 'FILE'
  4	2	Offset to the update sequence
  6	2	S=Size of the update sequence array + 1
  10	2	Sequence number
  12	2	Reference count
  14	2	Offset to the sequence of attributes part
  16	2	Flags
  18	4	Real size of the FILE record
  1C	4	Allocated size of the FILE record
  20	8	File reference to the base FILE record
  28	2	Maximum attribute Identificator + 1
  2A	2	Update sequence
  2C	2*(S-1)	Update sequence array

  Reference count

  A hard link count.

  Flags

  Bit	Signification
  00 01	In use
  00 02	The FILE record describes a directory

  File reference to the base FILE record

  • If the FILE record is a base FILE record, the file reference is 00 00 00 00 00 00 00 00.
  • If the FILE record is an extension FILE record, the file reference points to its corresponding base FILE record.

• The sequence of attributes part

  This is a sequence of file attributes that has a variable length. In each FILE record, the sequence is ordered by increasing order of the attribute type. The sequence is terminated with FF FF FF FF.

Properties

When a file is deleted, NTFS can't simply remove the associated FILE records from the MFT, otherwise FILE record numbers wouldn't be constant over time, and all file references would have to be updated! Instead, the in-use flag of a FILE record indicates when it is no longer in use. When a file is created, an unused FILE record can be re-used for it, but its sequence number is incremented by one. This mechanism allow NTFS to check that file references don't point to deleted files.