📄 attrdef.html
字号:
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><!-- http://linux-ntfs.sourceforge.net/ntfs/files/attrdef.html --><html lang="en"> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> <meta name="description" content="NTFS Documentation"> <link rel="stylesheet" type="text/css" href="../style/ntfsdoc.css"> <link rel="start" type="text/html" href="../index.html" title="NTFS Documentation"> <title>$AttrDef (4) - File - NTFS Documentation</title> </head> <body> <table border="0" class="toolbar" summary="" cellspacing="0"> <tr> <td class="toolbar"><a accesskey="1" class="toolbar" href="../index.html">Home</a></td> <td class="toolbar"> </td> <td class="toolbar"><a accesskey="2" class="toolbar" href="../files/index.html">Files</a></td> <td class="toolbar"> </td> <td class="toolbar"><a accesskey="3" class="toolbar" href="../attributes/index.html">Attributes</a></td> <td class="toolbar"> </td> <td class="toolbar"><a accesskey="4" class="toolbar" href="../concepts/index.html">Concepts</a></td> <td class="toolbar"> </td> <td class="toolbar"><a accesskey="5" class="toolbar" href="../help/glossary.html">Glossary</a></td> <td class="toolbar"> </td> <td class="toolbar"><a accesskey="6" class="toolbar" href="../help/index.html">Help</a></td> </tr> </table> <h1>File - $AttrDef (4)</h1> <a class="prevnext" accesskey="," href="volume.html">Previous</a> <a class="prevnext" accesskey="." href="dot.html">Next</a> <h2>Overview</h2> <p>This is a system file containing information about all the file attributes usable in a volume.</p> <pre>Attribute end marker 0xFFFFFFFF</pre> <h2><a class="heading" href="../attributes/index.html">Attributes</a></h2> <table border="1" summary="" cellspacing="0"> <tr> <th class="numeric">Type</th> <th>Description</th> <th>Name</th> </tr> <tr> <td class="numeric"><a class="numeric" href="../attributes/standard_information.html">0x10</a></td> <td><a href="../attributes/standard_information.html">$STANDARD_INFORMATION</a></td> <td> </td> </tr> <tr> <td class="numeric"><a class="numeric" href="../attributes/file_name.html">0x30</a></td> <td><a href="../attributes/file_name.html">$FILE_NAME</a></td> <td>$AttrDef</td> </tr> <tr> <td class="numeric"><a class="numeric" href="../attributes/security_descriptor.html">0x50</a></td> <td><a href="../attributes/security_descriptor.html">$SECURITY_DESCRIPTOR</a></td> <td> </td> </tr> <tr> <td class="numeric"><a class="numeric" href="../attributes/data.html">0x80</a></td> <td><a href="../attributes/data.html">$DATA</a></td> <td>[Unnamed]</td> </tr> </table> <h2>Layout of the File</h2> <h3>Unnamed Data Stream</h3> <p>Its layout is a sequence of records. Each record defines one file attribute, and its layout is:</p> <table border="1" summary="" cellspacing="0"> <tr> <th class="numeric">Offset</th> <th class="numeric">Size</th> <th>Description</th> </tr> <tr> <td class="numeric">0x00</td> <td class="numeric">128</td> <td>Label in Unicode</td> </tr> <tr> <td class="numeric">0x80</td> <td class="numeric">4</td> <td>Type</td> </tr> <tr> <td class="numeric">0x84</td> <td class="numeric">4</td> <td>Display rule</td> </tr> <tr> <td class="numeric">0x88</td> <td class="numeric">4</td> <td>Collation rule</td> </tr> <tr> <td class="numeric">0x8C</td> <td class="numeric">4</td> <td>Flags</td> </tr> <tr> <td class="numeric">0x90</td> <td class="numeric">8</td> <td>Minimum size</td> </tr> <tr> <td class="numeric">0x98</td> <td class="numeric">8</td> <td>Maximum size</td> </tr> </table> <h2>Notes</h2> <dl> <dt>Display Rule</dt> <dd>At the moment this is always zero</dd> <dt>Collation Rule</dt> <dd>At the moment this is always zero, but the possible values are:</dd> <dd> <table border="1" summary="" cellspacing="0"> <tr> <th class="numeric">Flag</th> <th>Description</th> </tr> <tr> <td class="numeric">0x00</td> <td>Binary</td> </tr> <tr> <td class="numeric">0x01</td> <td>Filename</td> </tr> <tr> <td class="numeric">0x02</td> <td>Unicode String</td> </tr> <tr> <td class="numeric">0x10</td> <td>Unsigned Long</td> </tr> <tr> <td class="numeric">0x11</td> <td>SID</td> </tr> <tr> <td class="numeric">0x12</td> <td>Security Hash</td> </tr> <tr> <td class="numeric">0x13</td> <td>Multiple Unsigned Longs</td> </tr> </table> </dd> <dt>Flags</dt> <dd> We've only witnessed three flags: 0x02, 0x40 and 0x80. It seems that 0x40 and 0x80 are never seen together. Therefore, the guess is that: </dd> <dd> <table border="1" summary="" cellspacing="0"> <tr> <th class="numeric">Flag</th> <th>Description</th> </tr> <tr> <td class="numeric">0x02</td> <td>Indexed</td> </tr> <tr> <td class="numeric">0x40</td> <td>Resident (always)</td> </tr> <tr> <td class="numeric">0x80</td> <td>Non-Resident (allowed to be)</td> </tr> </table> </dd> <dd> See the column <q>IRN</q> in the tables below. </dd> </dl> <h3>Windows NT Example</h3> <table border="1" summary="" cellspacing="0"> <tr> <th class="numeric">Type</th> <th>Name</th> <th class="numeric">Flags</th> <th>IRN</th> <th class="numeric">Min Size</th> <th class="numeric">Max Size</th> </tr> <tr> <td class="numeric"><a class="numeric" href="../attributes/standard_information.html">0x10</a></td> <td><a href="../attributes/standard_information.html">$STANDARD_INFORMATION</a></td> <td class="numeric">0x40</td> <td>R</td> <td class="numeric">0x30</td> <td class="numeric">0x30</td> </tr> <tr> <td class="numeric"><a class="numeric" href="../attributes/attribute_list.html">0x20</a></td> <td><a href="../attributes/attribute_list.html">$ATTRIBUTE_LIST</a></td> <td class="numeric">0x80</td> <td>N</td> <td class="numeric">-</td> <td class="numeric">-</td> </tr> <tr> <td class="numeric"><a class="numeric" href="../attributes/file_name.html">0x30</a></td> <td><a href="../attributes/file_name.html">$FILE_NAME</a></td> <td class="numeric">0x42</td> <td>IR</td> <td class="numeric">0x44</td> <td class="numeric">0x242</td> </tr> <tr> <td class="numeric"><a class="numeric" href="#obsolete">0x40</a></td> <td><a href="#obsolete">$VOLUME_VERSION</a></td> <td class="numeric">0x40</td> <td>R</td> <td class="numeric">0x8</td> <td class="numeric">0x8</td> </tr> <tr> <td class="numeric"><a class="numeric" href="../attributes/security_descriptor.html">0x50</a></td> <td><a href="../attributes/security_descriptor.html">$SECURITY_DESCRIPTOR</a></td> <td class="numeric">0x80</td> <td>N</td> <td class="numeric">-</td>⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -