NTFS standard two

 

 

 
When MFT record attribute too long, MFT record is fit so much property records, then you only the data in the form of a non-resident property stored in the volume of data to another location, or if so storing high, you must use the property sheet properties. Property holds no less than the MFT records will be transferred to a new assignment, and then add a property sheet in the original MFT attributes to describe how the search to all properties of the current file.
Immediately store each attribute description of standard properties after recording head records the position and location of the MFT record attributes, each attribute is described by four words aligned, recording the type of property, the name (well-known attributes), the serial number.
Properties property sheet does not include a description of their own.

Name
Offset
Size
Description
 
-
-
Standard attributes head
AL_RD_Type
0
4
Property Type
AL_RD_Len
4
2
Property Description Size
AL_RD_NamLen
6
1
Attribute name size is N
AL_RD_NamOff
7
1
Attribute name attribute describes the offset relative
AL_RD_StartVCN
8
8
The properties of the data stream begins cluster number
AL_RD_BaseFRS
0x10
8
The property records record number MFT record belongs.
Note: the lower the value is 6 bytes MFT record number, the high two bytes are the sequence number of the record MFT
AL_RD_AttrId
0x18
2
Property ID
AL_RD_Name
0x1a
2 * N
UNICODE string attribute name. The character string does not end with 0 mark
 

Note: Use the property sheet property is typically due to the following circumstances:
1. There are too many aliases file.
2. Too many fragments that describe the data flow to fill the MFT record.
3. There are too complex security description (no longer happen in the NTFS 3.0 future versions).
4. There are too many command stream, such as data streams.
 
FILE_NAME (0x30 resident property len = 68 ~ 578))
This attribute is used to describe the file name, the property always reside in the MFT record.
In the definition of $ AttrDef, the minimum size of the property is 68 bytes and the maximum is 578 bytes, so the maximum file name length is 255 bytes.
 

Name
Offset
Size
Description
 
-
-
Standard attribute header (24 bytes)
FN_ParentFR
0
8
MFT record index records the parent directory.
Note: the lower the value is 6 bytes MFT record number, the high two bytes are the sequence number of the record MFT
FN_CreatTime
8
8
Time file created
FN_AlterTime
0x10
8
File was last modified time
FN_MFTChg
0x18
8
MFT record file is modified time
FN_ReadTime
0x20
8
Last time access to files
FN_AllocSz
0x28
8
The space occupied by the file data size, the value aligned cluster size
FN_ValidSz
0x30
8
Real size document, file size index entries (directory entry) is displayed in the value. If the data file's attributes start cluster number is not 0 the entry is empty, then the need to check the file size, then you must visit SI Properties
FN_DOSAttr
0x38
4
DOS file attribute may be a combination of the following values:
0x0001     read only
0x0002     hide
0x0004     System
0x0020     Archive
0x0040     Device
0x0080     routine
0x0100     temporary files
0x0200     sparse file
0x0400     reparse points
0x0800     compression
0x1000     Offline
0x2000     No content index
0x4000     encryption
0x10000000 directory
Depending 0x20000000 Index
FN_EA_Reparse
0x3c
4
Extended attributes and links
FN_NameSz
0x40
1
The number of characters of the file name
FN_NamSpace
0x41
1
Namespace, the value may be one of any of the following values
0: POSIX can use all UNICODE characters except NULL and separators "/" other than the maximum of 255 characters can be used. Note: The ":" character is legal, but Windows does not allow to use.
1: Win32 Win32 is a subset of POSIX case insensitive, you can use the addition "," "," * "," ",":? "," / "," <","> "," \ " , "|" "." beyond any UNICODE characters, but the name can not or spaces at the end.
2: DOS DOS namespace is a subset of Win32 only supports ASCII code is greater than the space 8BIT uppercase character and does not support the following character "," "," * "," ",":? "," / "," <" , ">", "\", "|", "+", ",", ";", "="; same name must be named in the following format: 1 to 8 characters, then yes, then "." then from 1 to 3 characters.
3: Win32 & DOS namespace means that Win32 and DOS file names are stored in the same file name attribute.
FN_FileName
0x42
2 * L
Do not need to end with the characters 0

 

 

 
Domain name: www.mrtlab.com | | Telephone: +86-27-82621261 | Terms of use
MRT data recovery website,provides professional HDD firmware repair and data recovery technical resources!
Copyright 2003-2019 Powered By MrtLab