$INDEX_ROOT (0x90) - Attribute - NTFS Documentation
Description: NTFS Documentation

Home | Files | Attributes | Concepts | Glossary

# Attribute - $INDEX_ROOT (0x90)

Previous Next

## Overview

This is the root node of the B+ tree that implements an index (e.g. a directory). This file attribute is always resident.

        Always resident.

## Layout of the Attribute

        link up below

$INDEX_ROOT
  Standard Attribute Header
  Index Root
  Index Header
  Index Entry
  Index Entry
  ...

### Index Root

Offset | Size | Description
--- | --- | ---
~ | ~ | Standard Attribute Header
0x00 | 4 | Attribute Type
0x04 | 4 | Collation Rule
0x08 | 4 | Size of Index Allocation Entry (bytes)
0x0C | 1 | Clusters per Index Record
0x0D | 3 | Padding (Align to 8 bytes)

### Index Header

Offset | Size | Description
--- | --- | ---
0x00 | 4 | Offset to first Index Entry
0x04 | 4 | Total size of the Index Entries
0x08 | 4 | Allocated size of the Index Entries
0x0C | 1 | Flags
0x0D | 3 | Padding (align to 8 bytes)

## Notes

### Size

As defined in $AttrDef, this attribute has a no minimum or maximum size.

### Flags

Flag | Description
--- | ---
0x00 | Small Index (fits in Index Root)
0x01 | Large index (Index Allocation needed)

        silly to have a flag of 0x00, remove

The large index flag indicates whether the file attributes index allocation and bitmap are present (when the index is small enough to be stored completely in the root node, these two file attributes are missing).

### Sequence of index entries

This is a sequence of index entries that has a variable length. The sequence is terminated with a special index entry whose last entry flag is set.

        This is the header for indexes, describing the INDEX_ENTRY records, which
        follow the INDEX_HEADER. Together the index header and the index entries
        make up a complete index.

        This is followed by a sequence of index entries (INDEX_ENTRY structures)
        as described by the index header.

        When a directory is small enough to fit inside the index root then this
        is the only attribute describing the directory. When the directory is too
        large to fit in the index root, on the other hand, two aditional attributes
        are present: an index allocation attribute, containing sub-nodes of the B+
        directory tree (see below), and a bitmap attribute, describing which virtual
        cluster numbers (vcns) in the index allocation attribute are in use by an
        index block.

        NOTE: The root directory (FILE_$root) contains an entry for itself.

        struct {
                ATTR_TYPES type;
                Type of the indexed attribute. Is $FILENAME for directories, zero
                for view indexes. No other values allowed.
                COLLATION_RULES collation_rule;        Collation rule used to sort the
                index entries. If type is $FILENAME, this must be COLLATION_FILENAME.

                __u32 bytes_per_index_block;
                Byte size of each index block (in the index allocation attribute).

                __u8 clusters_per_index_block;
                Cluster size of each index block (in the index allocation attribute), when
                an index block is >= than a cluster, otherwise this will be the log of
                the size (like how the encoding of the mft record size and the index
                record size found in the boot sector work). Has to be a power of 2.
        }  INDEX_ROOT;

### List of Common Indexes

Name | Index Of | Used By
--- | --- | ---
$I30 | Filenames | Directories
$SDH | Security Descriptors | $Secure
$SII | Security Ids | $Secure
$O | Object Ids | $ObjId
$O | Owner Ids | $Quota
$Q | Quotas | $Quota
$R | Reparse Points | $Reparse

        which elements are shared between indexes?
        not relevant for index root

Copyright (C) Validate HTML Validate CSS