📄 attrdef.html
字号:
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//ZH_CN">
<!-- http://linux-ntfs.sourceforge.net/ntfs/files/attrdef.html -->
<html lang="ZH_CN">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<meta name="description" content="NTFS Documentation">
<link rel="stylesheet" type="text/css" href="../style/ntfsdoc.css">
<link rel="start" type="text/html" href="../index.html" title="NTFS Documentation">
<title>$AttrDef (4) - File - NTFS Documentation</title>
</head>
<body>
<table border="0" class="toolbar" summary="" cellspacing="0">
<tr>
<td class="toolbar"><div class="toolbar"><a accesskey="1" class="toolbar" href="../index.html">主页</a></div></td> <td class="toolbar"><div class="toolbar"><a accesskey="2" class="toolbar" href="../files/index.html">文件</a></div></td> <td class="toolbar"><div class="toolbar"><a accesskey="3" class="toolbar" href="../attributes/index.html">属性</a></div></td> <td class="toolbar"><div class="toolbar"><a accesskey="4" class="toolbar" href="../concepts/index.html">概念</a></div></td> <td class="toolbar"><a accesskey="5" class="toolbar" href="../help/glossary.html">词汇</a></td>
</tr>
</table>
<h1>文件 - $AttrDef (4)</h1>
<a class="prevnext" accesskey="," href="volume.html">前一页</a>
<a class="prevnext" accesskey="." href="dot.html">后一页</a>
<h2>概述</h2>
<p>这是一个包含所有在卷中用到的文件属性信息的系统文件。</p>
<pre>属性结尾标记为 0xFFFFFFFF</pre>
<h2><a class="heading" href="../attributes/index.html">属性</a></h2>
<table border="1" summary="" cellspacing="0">
<tr>
<th class="numeric">类型</th>
<th>描述</th>
<th>名称</th>
</tr>
<tr>
<td class="numeric"><a class="numeric" href="../attributes/standard_information.html">0x10</a></td>
<td><a href="../attributes/standard_information.html">标准信息 （$STANDARD_INFORMATION）</a></td>
<td> </td>
</tr>
<tr>
<td class="numeric"><a class="numeric" href="../attributes/file_name.html">0x30</a></td>
<td><a href="../attributes/file_name.html">文件名 （$FILE_NAME）</a></td>
<td>$AttrDef</td>
</tr>
<tr>
<td class="numeric"><a class="numeric" href="../attributes/security_descriptor.html">0x50</a></td>
<td><a href="../attributes/security_descriptor.html">安全描述符 （$SECURITY_DESCRIPTOR）</a></td>
<td> </td>
</tr>
<tr>
<td class="numeric"><a class="numeric" href="../attributes/data.html">0x80</a></td>
<td><a href="../attributes/data.html">数据 （$DATA）</a></td>
<td>[未命名]</td>
</tr>
</table>
<h2>文件结构</h2>
<h3>未命名数据流</h3>
<p>它的结构为一序列的记录，每个记录定义一个文件属性，它的结构如下：</p>
<table border="1" summary="" cellspacing="0">
<tr>
<th class="numeric">偏移量</th>
<th class="numeric">大小</th>
<th>描述</th>
</tr>
<tr>
<td class="numeric">0x00</td>
<td class="numeric">128</td>
<td>Unicode 编码的标签</td>
</tr>
<tr>
<td class="numeric">0x80</td>
<td class="numeric">4</td>
<td>类型</td>
</tr>
<tr>
<td class="numeric">0x84</td>
<td class="numeric">4</td>
<td>显示规则</td>
</tr>
<tr>
<td class="numeric">0x88</td>
<td class="numeric">4</td>
<td>整理规则</td>
</tr>
<tr>
<td class="numeric">0x8C</td>
<td class="numeric">4</td>
<td>标记</td>
</tr>
<tr>
<td class="numeric">0x90</td>
<td class="numeric">8</td>
<td>最小尺寸</td>
</tr>
<tr>
<td class="numeric">0x98</td>
<td class="numeric">8</td>
<td>最大尺寸</td>
</tr>
</table>
<h2>注意</h2>
<dl>
<dt>显示规则</dt>
<dd>此时总为零</dd>
<dt>整理规则</dt>
<dd>此时一般为零，但有可能是：</dd>
<dd>
<table border="1" summary="" cellspacing="0">
<tr>
<th class="numeric">标记</th>
<th>描述</th>
</tr>
<tr>
<td class="numeric">0x00</td>
<td>二进制</td>
</tr>
<tr>
<td class="numeric">0x01</td>
<td>文件名</td>
</tr>
<tr>
<td class="numeric">0x02</td>
<td>Unicode 编码字串</td>
</tr>
<tr>
<td class="numeric">0x10</td>
<td>无符号的长</td>
</tr>
<tr>
<td class="numeric">0x11</td>
<td>SID</td>
</tr>
<tr>
<td class="numeric">0x12</td>
<td>安全的无用信息</td>
</tr>
<tr>
<td class="numeric">0x13</td>
<td>多重无符号的长</td>
</tr>
</table>
</dd>
<dt>标记</dt>
<dd>
我们只证明3个标记：0x02, 0x40 and 0x80. 0x40 和 0x80好像从不在一起。
因此推测如下：
</dd>
<dd>
<table border="1" summary="" cellspacing="0">
<tr>
<th class="numeric">标记</th>
<th>描述</th>
</tr>
<tr>
<td class="numeric">0x02</td>
<td>被编入索引的</td>
</tr>
<tr>
<td class="numeric">0x40</td>
<td>常驻的</td>
</tr>
<tr>
<td class="numeric">0x80</td>
<td>非常驻的</td>
</tr>
</table>
</dd>
<dd>
观察下面表格中的<q>IRN</q>一栏
</dd>
</dl>
<h3>Windows NT Example</h3>
<table border="1" summary="" cellspacing="0">
<tr>
<th class="numeric">Type</th>
<th>Name</th>
<th class="numeric">Flags</th>
<th>IRN</th>
<th class="numeric">Min Size</th>
<th class="numeric">Max Size</th>
</tr>
<tr>
<td class="numeric"><a class="numeric" href="../attributes/standard_information.html">0x10</a></td>
<td><a href="../attributes/standard_information.html">$STANDARD_INFORMATION</a></td>
<td class="numeric">0x40</td>
<td>R</td>
<td class="numeric">0x30</td>
<td class="numeric">0x30</td>
</tr>
<tr>
<td class="numeric"><a class="numeric" href="../attributes/attribute_list.html">0x20</a></td>
<td><a href="../attributes/attribute_list.html">$ATTRIBUTE_LIST</a></td>
<td class="numeric">0x80</td>
<td>N</td>
<td class="numeric">-</td>
<td class="numeric">-</td>
</tr>
<tr>
<td class="numeric"><a class="numeric" href="../attributes/file_name.html">0x30</a></td>
<td><a href="../attributes/file_name.html">$FILE_NAME</a></td>
<td class="numeric">0x42</td>
<td>IR</td>
<td class="numeric">0x44</td>
<td class="numeric">0x242</td>
</tr>
<tr>
<td class="numeric"><a class="numeric" href="#obsolete">0x40</a></td>
<td><a href="#obsolete">$VOLUME_VERSION</a></td>
<td class="numeric">0x40</td>
<td>R</td>
<td class="numeric">0x8</td>
<td class="numeric">0x8</td>
</tr>
<tr>
<td class="numeric"><a class="numeric" href="../attributes/security_descriptor.html">0x50</a></td>
<td><a href="../attributes/security_descriptor.html">$SECURITY_DESCRIPTOR</a></td>
<td class="numeric">0x80</td>
<td>N</td>
<td class="numeric">-</td>
<td class="numeric">-</td>
</tr>
<tr>
<td class="numeric"><a class="numeric" href="../attributes/volume_name.html">0x60</a></td>
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -