|
Name
|
Offset
|
Size
|
Explanation
|
|
ATTR_Type
|
0x00
|
4
|
Property type. The value must be a list of attributes defined in the file $ AttrDef in a
|
|
ATTR_Size
|
0x04
|
4
|
Record size (including the recording head)
|
|
ATTR_NonResFlag
|
0x08
|
1
|
Non-resident property data symbol, is a
|
|
ATTR_NamSz
|
0x09
|
1
|
Attribute name size, the value of 0 indicates that the current property no name
|
|
ATTR_NamOff
|
0x0a
|
2
|
Attribute names the head relative to the offset property, the value is always fixed at 0x18
|
|
ATTR_Flags
|
0x0c
|
2
|
Attribute flags in the current version only supports the following three flags:
0x0001 property is compressed
0x4000 attribute is encrypted
0x8000 sparse property
Note: Data (Data) Only non-resident property can be compressed
|
|
ATTR_Id
|
0x0d
|
2
|
Attribute ID, each attribute in the MFT record has a unique ID.
|
|
ATTR_StartVCN
|
0x10
|
8
|
The properties of the data stream begins cluster number
|
|
ATTR_EndVCN
|
0x18
|
8
|
The attributes of the data stream cluster number of last cluster
|
|
ATTR_DataOff
|
0x20
|
2
|
Data stream offset relative to property described in the head, the data should be double-word aligned
|
|
ATTR_CmpSz
|
0x22
|
2
|
Compressed size of the unit. Compression unit size must be an integer power of 2, 0 indicates uncompressed
|
|
ATTR_Resvd
|
0x24
|
4
|
Retention
|
|
ATTR_AllocSz
|
0x28
|
8
|
Dimensions of space property record data block allocation, which is the size of the cluster size aligned
|
|
ATTR_ValidSz
|
0x30
|
8
|
The actual size of the data block attribute record
|
|
ATTR_InitedSz
|
0x38
|
8
|
Attribute Record data block size of the data has been initialized, the same date and attribute values assigned to the data block size of the recording
|
|
ATTR_AttrNam
|
0x40
|
2 * N
|
UNICODE string attribute names, the string does not end with 0
|
|
ATTR_DataRuns
|
0x40+2*N
|
|
Attribute data stream description (for the non-resident property logical cluster region pointing, pointing to specific entities in the region)
|
