NTFS Documentation: Index Entry

Definition

Layout

Offset to the beginning of the index entry	Length	Description
The next field is only valid when the last entry flag is not set
0	8	File reference
8	2	L = Length of the index entry
A	2	M = Length of the stream
C	1	Flags
The next field is only present when the last entry flag is not set
10	M	Stream
The next field is only present when the sub-node flag is set
L - 8	8	VCN of the sub-node in the index allocation attribute

Length of the stream

A copy of the field at offset 10 in the header part of the resident file attribute indexed by the index entry. But why the hell haven't these 2 fields the same size?

Flags

Bit	Signification
01	Index entry points to a sub-node
02	Last index entry in the node

The last entry flag is used to indicate the end of a sequence of index entries. Although it does not represent a valid file, it can point to a sub-node.

Stream

A copy of the stream of the resident file attribute indexed by the index entry (e.g. for a directory, the file name attribute).