attribute_header.html

这是NTFS文件0.5版本技术文件

        <td class="numeric">0x0A</td>
        <td class="numeric">2</td>
        <td class="numeric">0x00</td>
        <td>Offset to the Name</td>
      </tr>
      <tr>
        <td class="numeric">0x0C</td>
        <td class="numeric">2</td>
        <td class="numeric">&nbsp;</td>
        <td><a href="#flags">Flags</a></td>
      </tr>
      <tr>
        <td class="numeric">0x0E</td>
        <td class="numeric">2</td>
        <td class="numeric">&nbsp;</td>
        <td>Attribute Id (a)</td>
      </tr>
      <tr>
        <td class="numeric">0x10</td>
        <td class="numeric">8</td>
        <td class="numeric">&nbsp;</td>
        <td>Starting VCN</td>
      </tr>
      <tr>
        <td class="numeric">0x18</td>
        <td class="numeric">8</td>
        <td class="numeric">&nbsp;</td>
        <td>Last VCN</td>
      </tr>
      <tr>
        <td class="numeric">0x20</td>
        <td class="numeric">2</td>
        <td class="numeric">0x40</td>
        <td>Offset to the Data Runs</td>
      </tr>
      <tr>
        <td class="numeric">0x22</td>
        <td class="numeric">2</td>
        <td class="numeric">&nbsp;</td>
        <td>Compression Unit Size (b)</td>
      </tr>
      <tr>
        <td class="numeric">0x24</td>
        <td class="numeric">4</td>
        <td class="numeric">0x00</td>
        <td>Padding</td>
      </tr>
      <tr>
        <td class="numeric">0x28</td>
        <td class="numeric">8</td>
        <td class="numeric">&nbsp;</td>
        <td>Allocated size of the attribute (c)</td>
      </tr>
      <tr>
        <td class="numeric">0x30</td>
        <td class="numeric">8</td>
        <td class="numeric">&nbsp;</td>
        <td>Real size of the attribute</td>
      </tr>
      <tr>
        <td class="numeric">0x38</td>
        <td class="numeric">8</td>
        <td class="numeric">&nbsp;</td>
        <td>Initialized data size of the stream (d)</td>
      </tr>
      <tr>
        <td class="numeric">0x40</td>
        <td class="numeric">...</td>
        <td class="numeric">&nbsp;</td>
        <td>Data Runs</td>
      </tr>
    </table>

    <p>
    (a) Each attribute has a unique identifier<br>
    (b) Compression unit size = 2<sup>x</sup> clusters. 0 implies uncompressed<br>
    (c) This is the attribute size rounded up to the cluster size<br>
    (d) When is this not equal to the allocated size?
    </p>

    <h3>Non-Resident, Named</h3>

    <table border="1" summary="" cellspacing="0">
      <tr>
        <th class="numeric">Offset</th>
        <th class="numeric">Size</th>
        <th class="numeric">Value</th>
        <th>Description</th>
      </tr>
      <tr>
        <td class="numeric">0x00</td>
        <td class="numeric">4</td>
        <td class="numeric">&nbsp;</td>
        <td>Attribute Type (e.g. 0x80, 0xA0)</td>
      </tr>
      <tr>
        <td class="numeric">0x04</td>
        <td class="numeric">4</td>
        <td class="numeric">&nbsp;</td>
        <td>Length (including this header)</td>
      </tr>
      <tr>
        <td class="numeric">0x08</td>
        <td class="numeric">1</td>
        <td class="numeric">0x01</td>
        <td>Non-resident flag</td>
      </tr>
      <tr>
        <td class="numeric">0x09</td>
        <td class="numeric">1</td>
        <td class="numeric">N</td>
        <td>Name length</td>
      </tr>
      <tr>
        <td class="numeric">0x0A</td>
        <td class="numeric">2</td>
        <td class="numeric">0x40</td>
        <td>Offset to the Name</td>
      </tr>
      <tr>
        <td class="numeric">0x0C</td>
        <td class="numeric">2</td>
        <td class="numeric">&nbsp;</td>
        <td><a href="#flags">Flags</a></td>
      </tr>
      <tr>
        <td class="numeric">0x0E</td>
        <td class="numeric">2</td>
        <td class="numeric">&nbsp;</td>
        <td>Attribute Id (a)</td>
      </tr>
      <tr>
        <td class="numeric">0x10</td>
        <td class="numeric">8</td>
        <td class="numeric">&nbsp;</td>
        <td>Starting VCN</td>
      </tr>
      <tr>
        <td class="numeric">0x18</td>
        <td class="numeric">8</td>
        <td class="numeric">&nbsp;</td>
        <td>Last VCN</td>
      </tr>
      <tr>
        <td class="numeric">0x20</td>
        <td class="numeric">2</td>
        <td class="numeric">2N+0x40</td>
        <td>Offset to the Data Runs (b)</td>
      </tr>
      <tr>
        <td class="numeric">0x22</td>
        <td class="numeric">2</td>
        <td class="numeric">&nbsp;</td>
        <td>Compression Unit Size (c)</td>
      </tr>
      <tr>
        <td class="numeric">0x24</td>
        <td class="numeric">4</td>
        <td class="numeric">0x00</td>
        <td>Padding</td>
      </tr>
      <tr>
        <td class="numeric">0x28</td>
        <td class="numeric">8</td>
        <td class="numeric">&nbsp;</td>
        <td>Allocated size of the attribute (d)</td>
      </tr>
      <tr>
        <td class="numeric">0x30</td>
        <td class="numeric">8</td>
        <td class="numeric">&nbsp;</td>
        <td>Real size of the attribute</td>
      </tr>
      <tr>
        <td class="numeric">0x38</td>
        <td class="numeric">8</td>
        <td class="numeric">&nbsp;</td>
        <td>Initialized data size of the stream (e)</td>
      </tr>
      <tr>
        <td class="numeric">0x40</td>
        <td class="numeric">2N</td>
        <td class="numeric">Unicode</td>
        <td>The Attribute's Name</td>
      </tr>
      <tr>
        <td class="numeric">2N+0x40</td>
        <td class="numeric">...</td>
        <td class="numeric">&nbsp;</td>
        <td>Data Runs (b)</td>
      </tr>
    </table>

    <p>
    (a) Each attribute has a unique identifier<br>
    (b) Rounded up to a multiple of 4 bytes<br>
    (c) Compression unit size = 2<sup>x</sup> clusters. 0 implies uncompressed<br>
    (d) This is the attribute size rounded up to the cluster size<br>
    (e) When is this not equal to the allocated size?
    </p>

    <h2>Flags</h2>

    <a name="flags"></a>
    <table border="1" summary="" cellspacing="0">
      <tr>
        <th class="numeric">Flag</th>
        <th>Description</th>
      </tr>
      <tr>
        <td class="numeric">0x0001</td>
        <td>Compressed</td>
      </tr>
      <tr>
        <td class="numeric">0x4000</td>
        <td>Encrypted</td>
      </tr>
      <tr>
        <td class="numeric">0x8000</td>
        <td>Sparse</td>
      </tr>
    </table>

    <h2>Notes</h2>

    <h3>Other Information</h3>

    <p>
    Only the data attribute can be compressed, or sparse,
    and only when it is non-resident.
    </p>

    <p>
    Although the compression flag is stored in the header,
    it does not affect the size of the header.
    </p>

    <pre>
    name isn't null terminated
    </pre>

    <pre>
    FIXME
    0x40 __s64 compressed_size;
    Byte size of the attribute value after compression.
    Only present when compressed. Always is a multiple of the cluster
    size. Represents the actual amount of disk space being used on the disk.
    </pre>

    <p>
    FIXME:
    The indexed flag only appears in the resident attributes.
    Does this mean you can only index resident attributes?
    </p>

    <br>
    <a class="contact" href="http://linux-ntfs.sourceforge.net/ntfs/concepts/attribute_header.html">Online</a>
    <!-- The two validators will only work if this page is visible on the web -->
    <a class="contact" href="http://validator.w3.org/check/referer">Validate HTML</a>
    <a class="contact" href="http://jigsaw.w3.org/css-validator/check/referer">Validate CSS</a>
    <a class="contact" href="mailto:[e-mail]">$Id: attribute_header.html,v 1.12 2001/07/11 11:04:05 flatcap Exp $</a>
  </body>
</html>