attr.html

NTFS 磁盘系统 加载源代码

<title>Attribute List</title>
The layout of an attribute is
<pre>
offset(length)          Description
0(4)                    Type
4(4)                    Length
8(1)                    0=resident, 1=data stored in runs
9(1)                    name length
A(1)                    offset to name or resident data
C(1)                    1=compressed
E(2)                    Attribute ID
Resident attributes:
10(2)                  data length
14(2)                  offset to data
16(2)                  attribute is indexed
Nonresident attributes:
10(8)                   starting VCN of this segment
18(8)                   last VCN of this segment
20(2)                   offset to data
22(2?)                  Number of compression engine ? '4' for compressed files
28(8)                   size of the attribute
30(8)                   allocated disk space
38(8)                   length of initialized data
40(8)                   compressed size
All:
data start              Name (if present)
data start + namelen    start of data or data runs
</pre>

The following attribute types are known. The list of attributes of a volume
is stored in the <a href="AttrDef.html">$Attribute</a> file.
<ul>
<li><a href="standard.html">Standard information</a> (10)
<li><a href="attrlist.html">Attribute list</a> (20)
<li><a href="filename.html">File name</a> (30)
<li>Volume version (40)
<li>Security descriptor (50)
<li>Volume name (60)
<li>Volume information (70)
<li><a href="data.html">Data</a> (80)
<li><a href="indexroot.html">Index root</a> (90)
<li><a href="indexallocation.html">Index Allocation</a> (A0)
<li><a href=abitmap.html>Bitmap</a> (B0)
<li>Symlink (C0)
<li>HPFS extended attributes information (D0)
<li>HPFS extended attributes (E0)
</ul>
<i>The data structure of the attributes 20,40,50,60,70,B0,C0,D0, and E0 
is unknown.
The purpose of the indexed flag is unknown, as well as its presence for
non-resident attributes.
</i>
<p>
For nonresident attributes, the data is stored in <a href=runs.html>runs</a>.