$Quota (Any) - File - NTFS Documentation
Description: NTFS Documentation

Home | Files | Attributes | Concepts | Glossary

# File - $Quota (Any)

Previous Next

## Overview

This file first appeared in Window NT, but wan't used. In Windows 2000, and later, it keeps track of file quotas. Quotas are kept per person and per volume.

## Attributes

Type | Description | Name
--- | --- | ---
0x10 | $STANDARD_INFORMATION |
0x30 | $FILE_NAME | $Quota
0x90 | $INDEX_ROOT | $O
0x90 | $INDEX_ROOT | $Q
0xA0 | $INDEX_ALLOCATION | $O
0xA0 | $INDEX_ALLOCATION | $Q
0xB0 | $BITMAP | $O
0xB0 | $BITMAP | $Q

## Layout of the File

### $O Index

Offset | Size | Value | Description
--- | --- | --- | ---
~ | ~ | ~ | Standard Index Header
0x00 | 2 | 0x1C | Offset to data
0x02 | 2 | 0x04 | Size of data
0x04 | 4 | 0x00 | Padding
0x08 | 2 | 0x20 | Size of Index Entry
0x0A | 2 | 0x0C | Size of Index Key (K)
0x0C | 2 |  | Flags
0x0E | 2 | 0x00 | Padding
0x10 | K |  | Key | SID
K+0x10 | 4 |  | Data | Owner Id
K+0x14 | P |  | Data | Padding8

    Flags?

### $Q Index

    header & repeating group

Offset | Size | Value | Description
--- | --- | --- | ---
~ | ~ | ~ | Standard Index Header
0x00 | 2 | 0x14 | Offset to data
0x02 | 2 |  | Size of data
0x04 | 4 | 0x00 | Padding
0x08 | 2 |  | Size of Index Entry
0x0A | 2 | 0x04 | Size of Index Key
0x0C | 4 | 0x00 | Padding
0x10 | 4 |  | Key | Owner Id
0x14 | 4 | 0x02 | Data | Version
0x18 | 4 |  | Data | Flags
0x1C | 8 |  | Data | Bytes Used
0x24 | 8 |  | Data | Change Time
0x2C | 8 |  | Data | Warning Limit
0x34 | 8 |  | Data | Hard Limit
0x3C | 8 |  | Data | Exceeded Time
0x44 | V |  | Data | SID
V+0x44 | P | 0x00 | Data | Padding8

        sid may be missing (quota flags = default limit => no SID, just padding)
        padding may not be necessary
        index key - xref to which index?
        change time - date/time
        exceeded time - 10/4/01 (not +5 days)
        in the last (null) entry, the padding at 0x0C = 0x02

### Flags

Flag | Description
--- | ---
0x0001 | Default Limits
0x0002 | Limit Reached
0x0004 | Id Deleted
0x0010 | Tracking Enabled
0x0020 | Enforcement Enabled
0x0040 | Tracking Requested
0x0080 | Log Threshold
0x0100 | Log Limit
0x0200 | Out Of Date
0x0400 | Corrupt
0x0800 | Pending Deletes

## Notes

### Other Information

The index is called $O. This is an index of Owner Ids. It should not be confused with the index of the same name, used by the Metadata File $ObjId.

A file's Owner Id is stored in the $STANDARD_INFORMATION Attribute. The Owner Id can be looked up in $O, to give a Security Id (SID) or looked up in $Q to provide quota information.

        The $Q index contains one entry for each existing user_id on the volume. The
        index key is the user_id of the user/group owning this quota control entry,
        i.e. the key is the owner_id. The user_id of the owner of a file, i.e. the
        owner_id, is found in the standard information attribute. The collation rule
        for $Q is COLLATION_NTOFS_ULONG.

        The $O index contains one entry for each user/group who has been assigned
        a quota on that volume. The index key holds the SID of the user_id the
        entry belongs to, i.e. the owner_id. The collation rule for $O is
        COLLATION_NTOFS_SID.

        The $O index entry data is the user_id of the user corresponding to the SID.
        This user_id is used as an index into $Q to find the quota control entry
        associated with the SID.

Copyright (C) Validate HTML Validate CSS