$ObjId (Any) - File - NTFS Documentation
Description: NTFS Documentation

Home | Files | Attributes | Concepts | Glossary

# File - $ObjId (Any)

Previous Next

## Overview

This system file is an index of all the $OBJECT_ID Attributes in use on the volume. See the $OBJECT_ID page for more details.

## Attributes

Type | Description | Name
--- | --- | ---
0x10 | $STANDARD_INFORMATION |
0x30 | $FILE_NAME | $ObjId
0x90 | $INDEX_ROOT | $O
0xA0 | $INDEX_ALLOCATION | $O
0xB0 | $BITMAP | $O

## Layout of the File

### $O Index

Offset | Size | Value | Description
--- | --- | --- | ---
~ | ~ | ~ | Standard Index Header
0x00 | 2 | 0x20 | Offset to data
0x02 | 2 | 0x38 | Size of data
0x04 | 4 | 0x00 | Padding
0x08 | 2 | 0x58 | Size of Index Entry
0x0A | 2 | 0x10 | Size of Index Key
0x0C | 2 |  | Flags
0x0E | 2 | 0x00 | Padding
0x10 | 16 |  | Key | GUID Object Id
0x20 | 8 |  | Data | MFT Reference
0x28 | 16 |  | Data | GUID Birth Volume Id
0x38 | 16 |  | Data | GUID Birth Object Id
0x48 | 16 |  | Data | GUID Domain Id

### Flags

Flag | Description
--- | ---
0x01 | Entry has subnodes
0x02 | Last Entry

## Notes

### Other Information

The index is called $O. This is an index of Object Ids. It should not be confused with the index of the same name, used by the Metadata File $Quota.

The index, $O, is sorted by GUID (0x13). This Collation Rule is specified in the Index Root.

A file's $OBJECT_ID Attribute has a GUID that can be found in this Index. The Index's data provides an MFT reference back to the file.

Copyright (C) Validate HTML Validate CSS