NTFS Documentation: Index Root Attribute

Definition

Layout of the stream

Offset to the beginning of the stream	Length	Description
0	4	Type of the indexed attribute
4	4	Always 00 00 00 01?
8	4	Size of index buffers ?
C	4	Number of clusters per index buffer ?
10	4	Always 00 00 00 10 ?
14	4	Size of the sequence of index entries + 10
18	4	Size of the sequence of index entries + 10 (sic)
1C	4	Flags
20		Sequence of index entries

Flags

Bit	Signification
00 00 00 01	Large index

The large index flag indicates whether the file attributes index allocation and bitmap are present (when the index is small enough to be stored completely in the root node, these two file attributes are missing).

Sequence of index entries

This is a sequence of index entries that has a variable length. The sequence is terminated with a special index entry whose last entry flag is set.