📄 attribute_header.html
字号:
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><!-- http://linux-ntfs.sourceforge.net/ntfs/concepts/attribute_header.html --><html lang="en"> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> <meta name="description" content="NTFS Documentation"> <link rel="stylesheet" type="text/css" href="../style/ntfsdoc.css"> <link rel="start" type="text/html" href="../index.html" title="NTFS Documentation"> <title>Attribute - Concept - NTFS Documentation</title> </head> <body> <table border="0" class="toolbar" summary="" cellspacing="0"> <tr> <td class="toolbar"><a accesskey="1" class="toolbar" href="../index.html">Home</a></td> <td class="toolbar"> </td> <td class="toolbar"><a accesskey="2" class="toolbar" href="../files/index.html">Files</a></td> <td class="toolbar"> </td> <td class="toolbar"><a accesskey="3" class="toolbar" href="../attributes/index.html">Attributes</a></td> <td class="toolbar"> </td> <td class="toolbar"><a accesskey="4" class="toolbar" href="../concepts/index.html">Concepts</a></td> <td class="toolbar"> </td> <td class="toolbar"><a accesskey="5" class="toolbar" href="../help/glossary.html">Glossary</a></td> <td class="toolbar"> </td> <td class="toolbar"><a accesskey="6" class="toolbar" href="../help/index.html">Help</a></td> </tr> </table> <h1>Concept - Attribute Header</h1> <a class="prevnext" accesskey="," href="index.html">Previous</a> <a class="prevnext" accesskey="." href="attribute_id.html">Next</a> <h2>Overview</h2> <p> Every attribute in every MFT record has a standard header. The header stores information about the attribute's type, size, name (optional) and whether it is resident, or not. </p> <p> The size of the attribute depends on two things. Does it have a name? Is it resident? To simplify the tables, all four possibilities will be shown in full (with some values already filled in). </p> <h2>Standard Attribute Header</h2> <h3>Resident, No Name</h3> <table border="1" summary="" cellspacing="0"> <tr> <th class="numeric">Offset</th> <th class="numeric">Size</th> <th class="numeric">Value</th> <th>Description</th> </tr> <tr> <td class="numeric">0x00</td> <td class="numeric">4</td> <td class="numeric"> </td> <td>Attribute Type (e.g. 0x10, 0x60)</td> </tr> <tr> <td class="numeric">0x04</td> <td class="numeric">4</td> <td class="numeric"> </td> <td>Length (including this header)</td> </tr> <tr> <td class="numeric">0x08</td> <td class="numeric">1</td> <td class="numeric">0x00</td> <td>Non-resident flag</td> </tr> <tr> <td class="numeric">0x09</td> <td class="numeric">1</td> <td class="numeric">0x00</td> <td>Name length</td> </tr> <tr> <td class="numeric">0x0A</td> <td class="numeric">2</td> <td class="numeric">0x18</td> <td>Offset to the Attribute</td> </tr> <tr> <td class="numeric">0x0C</td> <td class="numeric">2</td> <td class="numeric">0x00</td> <td><a href="#flags">Flags</a></td> </tr> <tr> <td class="numeric">0x0E</td> <td class="numeric">2</td> <td class="numeric"> </td> <td>Attribute Id (a)</td> </tr> <tr> <td class="numeric">0x10</td> <td class="numeric">4</td> <td class="numeric">L</td> <td>Length of the Attribute</td> </tr> <tr> <td class="numeric">0x14</td> <td class="numeric">2</td> <td class="numeric">0x18</td> <td>Offset to the Attribute</td> </tr> <tr> <td class="numeric">0x16</td> <td class="numeric">1</td> <td class="numeric"> </td> <td>Indexed flag</td> </tr> <tr> <td class="numeric">0x17</td> <td class="numeric">1</td> <td class="numeric">0x00</td> <td>Padding</td> </tr> <tr> <td class="numeric">0x18</td> <td class="numeric">L</td> <td class="numeric"> </td> <td>The Attribute</td> </tr> </table> <p> (a) Each attribute has a unique identifier </p> <h3>Resident, Named</h3> <table border="1" summary="" cellspacing="0"> <tr> <th class="numeric">Offset</th> <th class="numeric">Size</th> <th class="numeric">Value</th> <th>Description</th> </tr> <tr> <td class="numeric">0x00</td> <td class="numeric">4</td> <td class="numeric"> </td> <td>Attribute Type (e.g. 0x90, 0xB0)</td> </tr> <tr> <td class="numeric">0x04</td> <td class="numeric">4</td> <td class="numeric"> </td> <td>Length (including this header)</td> </tr> <tr> <td class="numeric">0x08</td> <td class="numeric">1</td> <td class="numeric">0x00</td> <td>Non-resident flag</td> </tr> <tr> <td class="numeric">0x09</td> <td class="numeric">1</td> <td class="numeric">N</td> <td>Name length</td> </tr> <tr> <td class="numeric">0x0A</td> <td class="numeric">2</td> <td class="numeric">0x18</td> <td>Offset to the Name</td> </tr> <tr> <td class="numeric">0x0C</td> <td class="numeric">2</td> <td class="numeric">0x00</td> <td><a href="#flags">Flags</a></td> </tr> <tr> <td class="numeric">0x0E</td> <td class="numeric">2</td> <td class="numeric"> </td> <td>Attribute Id (a)</td> </tr> <tr> <td class="numeric">0x10</td> <td class="numeric">4</td> <td class="numeric">L</td> <td>Length of the Attribute</td> </tr> <tr> <td class="numeric">0x14</td> <td class="numeric">2</td> <td class="numeric">2N+0x18</td> <td>Offset to the Attribute (b)</td> </tr> <tr> <td class="numeric">0x16</td> <td class="numeric">1</td> <td class="numeric"> </td> <td>Indexed flag</td> </tr> <tr> <td class="numeric">0x17</td> <td class="numeric">1</td> <td class="numeric">0x00</td> <td>Padding</td> </tr> <tr> <td class="numeric">0x18</td> <td class="numeric">2N</td> <td class="numeric">Unicode</td> <td>The Attribute's Name</td> </tr> <tr> <td class="numeric">2N+0x18</td> <td class="numeric">L</td> <td class="numeric"> </td> <td>The Attribute (c)</td> </tr> </table> <p> (a) Resident attributes cannot be compressed<br> (b) Each attribute has a unique identifier<br> (c) Rounded up to a multiple of 4 bytes </p> <h3>Non-Resident, No Name</h3> <table border="1" summary="" cellspacing="0"> <tr> <th class="numeric">Offset</th> <th class="numeric">Size</th> <th class="numeric">Value</th> <th>Description</th> </tr> <tr> <td class="numeric">0x00</td> <td class="numeric">4</td> <td class="numeric"> </td> <td>Attribute Type (e.g. 0x20, 0x80)</td> </tr> <tr> <td class="numeric">0x04</td> <td class="numeric">4</td> <td class="numeric"> </td> <td>Length (including this header)</td> </tr> <tr> <td class="numeric">0x08</td> <td class="numeric">1</td> <td class="numeric">0x01</td> <td>Non-resident flag</td> </tr> <tr> <td class="numeric">0x09</td> <td class="numeric">1</td> <td class="numeric">0x00</td> <td>Name length</td> </tr> <tr>⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -