NTFS Documentation: File Attribute

Definition

Properties

• Each file attribute is made of:
  • An important sequence of bytes called stream which constitutes the actual value of the attribute.
  • Metadata to access the stream.

• Each file attribute in a file may have a name: in this case, you can access its stream using the syntax file_name:attribute_name (that's why you can't use the character ':' in file names) through the command line interface.

• Windows NT® uses the following pre-defined file attributes listed in the metadata file $AttrDef.

  Type	Label
  10	$STANDARD_INFORMATION
  20	$ATTRIBUTE_LIST
  30	$FILE_NAME
  40	$VOLUME_VERSION
  50	$SECURITY_DESCRIPTOR
  60	$VOLUME_NAME
  70	$VOLUME_INFORMATION
  80	$DATA
  90	$INDEX_ROOT
  A0	$INDEX_ALLOCATION
  B0	$BITMAP
  C0	$SYMBOLIC_LINK
  D0	$EA_INFORMATION
  E0	$EA

Layout

• The content part

  Its layout always starts with the attribute name (N bytes long), but what follows defines the "residence" property of the file attribute:
  • The file attribute is resident when the stream of the file attribute is stored just after its name, providing better access times for file attributes with a small and not likely to grow stream.

  • When a file attribute is non-resident, its stream is stored in one or more extensions also called runs. A run is a contiguous area of LCNs. To reach these runs, NTFS stores a table called runlist just after the name of the file attribute.

• The header part

  Offset to the beginning of the header part	Length	Description
  0	4	Type
  4	4	Length
  8	1	Non-resident flag
  9	1	N=Name length
  A	2	Offset to the content part
  C	2	Compressed flag
  E	2	Identificator

  Name length

  00 if the file attribute has no name.

  Compressed flag

  In NTFS, data compression is implemented at a file attribute level, which means that you won't loose a lot of data if a corruption occurs :). It is although only used at a file level: a compressed file means that its data attribute is compressed.

  From now on, the layout of the header part depends on the residence of the file attribute:
  • For a resident file attribute,

    Offset to the beginning of the header part	Length	Description
    10	4	Length of the stream
    14	2	Offset to the stream
    16	2	Indexed flag

    Indexed flag

    The file attribute is indexed by an index entry.

  • For a non-resident file attribute,

    Offset to the beginning of the header part	Length	Description
    10	8	Starting VCN
    18	8	Last VCN
    20	2	Offset to the runlist
    22	2?	Number of compression engine ?
    28	8	Allocated size of the stream
    30	8	Real size of the stream
    38	8	Initialized data size of the stream

    VCN

    An acronym which stands for Virtual Cluster Number. The VCN is a notion relative to a non-resident file attribute. VCNs are ordered from the first cluster (VCN 0) of the first run containing the stream of the file attribute to the last cluster of the last run.

    When the runlist is very large, the file attribute can't fit into a single FILE record. So it is present in several FILE records describing the file, and the runlist in splitted into several pieces. Both Starting VCN and Last VCN fields are useful to find the good FILE record pointing to - via the runlist - the run containing a given VCN.

    Note: If the attribute can fit into a single FILE record, the Last VCN field (unuseful in this case) can be 00 00 00 00 00 00 00 00.

    Number of compression engine

    In order to reach the best compression rate, NTFS is able to use different compression engines according to the data type to compress. The current compression engine uses the value 04.

    Allocated size of the stream

    This is a multiple of the cluster size that represents the allocated space used to store on the volume the stream of the file attribute. If the stream is not compressed, it is its real size rounded up to a multiple of the cluster size. Otherwise, it is smaller.

    Real size of the stream

    The uncompressed size of the stream of the file attribute.

    Initialized data size of the stream

    This is the compressed size (always lower than the allocated size) of the stream of the file attribute. If the stream is not compressed, it is its real size.

  Note:
  • A resident file attribute is never compressed (and has no "number of compression engine" field) because its stream is too small.

  • Information is redundant: Name length + Offset to the content part = Offset to the stream (if resident) or Offset to the runlist (if non-resident).

Interest

Questions