📄 attribute_header.html
字号:
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//ZH_CN">
<!-- http://linux-ntfs.sourceforge.net/ntfs/concepts/attribute_header.html -->
<html lang="zh_ch">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<meta name="description" content="NTFS Documentation">
<link rel="stylesheet" type="text/css" href="../style/ntfsdoc.css">
<link rel="start" type="text/html" href="../index.html" title="NTFS Documentation">
<title>Attribute - Concept - NTFS Documentation</title>
</head>
<body>
<table border="0" class="toolbar" summary="" cellspacing="0">
<tr>
<td class="toolbar"><div class="toolbar"><a accesskey="1" class="toolbar" href="../index.html">主页</a></div></td> <td class="toolbar"><div class="toolbar"><a accesskey="2" class="toolbar" href="../files/index.html">文件</a></div></td> <td class="toolbar"><div class="toolbar"><a accesskey="3" class="toolbar" href="../attributes/index.html">属性</a></div></td> <td class="toolbar"><div class="toolbar"><a accesskey="4" class="toolbar" href="../concepts/index.html">概念</a></div></td> <td class="toolbar"><a accesskey="5" class="toolbar" href="../help/glossary.html">词汇</a></td>
</tr>
</table>
<h1>概念 - Attribute Header</h1>
<a class="prevnext" accesskey="," href="index.html">前一页</a>
<a class="prevnext" accesskey="." href="attribute_id.html">后一页</a>
<h2>概述</h2>
<p>
每一个MFT记录的每个属性都有一个标准标题。这个标题存储了有关属性类型，大小，名称（可选）和是否常驻的信息。
</p>
<p>
此属性的大小取决于两方面：是否有名称，是否常驻。为了简化表格，所有四个可能性都全部显示（有些值已经填好了）。 </p>
<h2>标准属性标题</h2>
<h3>常驻,无名称</h3>
<table border="1" summary="" cellspacing="0">
<tr>
<th class="numeric">偏移量</th>
<th class="numeric">大小</th>
<th class="numeric">值</th>
<th>描述</th>
</tr>
<tr>
<td class="numeric">0x00</td>
<td class="numeric">4</td>
<td class="numeric"> </td>
<td>属性类型 (如 0x10, 0x60)</td>
</tr>
<tr>
<td class="numeric">0x04</td>
<td class="numeric">4</td>
<td class="numeric"> </td>
<td>长度 (包括此标题)</td>
</tr>
<tr>
<td class="numeric">0x08</td>
<td class="numeric">1</td>
<td class="numeric">0x00</td>
<td>非常驻标记</td>
</tr>
<tr>
<td class="numeric">0x09</td>
<td class="numeric">1</td>
<td class="numeric">0x00</td>
<td>名称长度</td>
</tr>
<tr>
<td class="numeric">0x0A</td>
<td class="numeric">2</td>
<td class="numeric">0x18</td>
<td>到名称的偏移量</td>
</tr>
<tr>
<td class="numeric">0x0C</td>
<td class="numeric">2</td>
<td class="numeric">0x00</td>
<td><a href="#flags">标记</a></td>
</tr>
<tr>
<td class="numeric">0x0E</td>
<td class="numeric">2</td>
<td class="numeric"> </td>
<td>属性标识符 (a)</td>
</tr>
<tr>
<td class="numeric">0x10</td>
<td class="numeric">4</td>
<td class="numeric">L</td>
<td>属性长度</td>
</tr>
<tr>
<td class="numeric">0x14</td>
<td class="numeric">2</td>
<td class="numeric">0x18</td>
<td>到属性的偏移量</td>
</tr>
<tr>
<td class="numeric">0x16</td>
<td class="numeric">1</td>
<td class="numeric"> </td>
<td>编入索引的标记</td>
</tr>
<tr>
<td class="numeric">0x17</td>
<td class="numeric">1</td>
<td class="numeric">0x00</td>
<td>填料</td>
</tr>
<tr>
<td class="numeric">0x18</td>
<td class="numeric">L</td>
<td class="numeric"> </td>
<td>属性</td>
</tr>
</table>
<p>
(a) 每个属性都有一个唯一的标识符。
</p>
<h3>常驻, 命名的</h3>
<table border="1" summary="" cellspacing="0">
<tr>
<th class="numeric">偏移量</th>
<th class="numeric">大小</th>
<th class="numeric">值</th>
<th>描述</th>
</tr>
<tr>
<td class="numeric">0x00</td>
<td class="numeric">4</td>
<td class="numeric"> </td>
<td>属性类型 (如 0x90, 0xB0)</td>
</tr>
<tr>
<td class="numeric">0x04</td>
<td class="numeric">4</td>
<td class="numeric"> </td>
<td>长度 (包括此标题)</td>
</tr>
<tr>
<td class="numeric">0x08</td>
<td class="numeric">1</td>
<td class="numeric">0x00</td>
<td>非常驻标记</td>
</tr>
<tr>
<td class="numeric">0x09</td>
<td class="numeric">1</td>
<td class="numeric">N</td>
<td>名称的长度</td>
</tr>
<tr>
<td class="numeric">0x0A</td>
<td class="numeric">2</td>
<td class="numeric">0x18</td>
<td>到名称的偏移量</td>
</tr>
<tr>
<td class="numeric">0x0C</td>
<td class="numeric">2</td>
<td class="numeric">0x00</td>
<td><a href="#flags">标记</a></td>
</tr>
<tr>
<td class="numeric">0x0E</td>
<td class="numeric">2</td>
<td class="numeric"> </td>
<td>属性标识符 (a)</td>
</tr>
<tr>
<td class="numeric">0x10</td>
<td class="numeric">4</td>
<td class="numeric">L</td>
<td>属性长度</td>
</tr>
<tr>
<td class="numeric">0x14</td>
<td class="numeric">2</td>
<td class="numeric">2N+0x18</td>
<td>到属性的偏移量（b）</td>
</tr>
<tr>
<td class="numeric">0x16</td>
<td class="numeric">1</td>
<td class="numeric"> </td>
<td>编入索引的标记</td>
</tr>
<tr>
<td class="numeric">0x17</td>
<td class="numeric">1</td>
<td class="numeric">0x00</td>
<td>填料</td>
</tr>
<tr>
<td class="numeric">0x18</td>
<td class="numeric">2N</td>
<td class="numeric">Unicode</td>
<td>属性名称</td>
</tr>
<tr>
<td class="numeric">2N+0x18</td>
<td class="numeric">L</td>
<td class="numeric"> </td>
<td>属性 (c)</td>
</tr>
</table>
<p>
(a) 常驻属性不能压缩<br>
(b) 每个属性有唯一的标识符<br>
(c) 上舍入成4字节的倍数
</p>
<h3>非常驻, 无名称</h3>
<table border="1" summary="" cellspacing="0">
<tr>
<th class="numeric">偏移量</th>
<th class="numeric">大小</th>
<th class="numeric">值</th>
<th>描述</th>
</tr>
<tr>
<td class="numeric">0x00</td>
<td class="numeric">4</td>
<td class="numeric"> </td>
<td>属性类型 (如 0x20, 0x80)</td>
</tr>
<tr>
<td class="numeric">0x04</td>
<td class="numeric">4</td>
<td class="numeric"> </td>
<td>长度 (包括此标题)</td>
</tr>
<tr>
<td class="numeric">0x08</td>
<td class="numeric">1</td>
<td class="numeric">0x01</td>
<td>非常驻标记</td>
</tr>
<tr>
<td class="numeric">0x09</td>
<td class="numeric">1</td>
<td class="numeric">0x00</td>
<td>名称长度</td>
</tr>
<tr>
<td class="numeric">0x0A</td>
<td class="numeric">2</td>
<td class="numeric">0x00</td>
<td>到名称的偏移量</td>
</tr>
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -