Index Header - Concept - NTFS Documentation
Description: NTFS Documentation

Home | Files | Attributes | Concepts | Glossary

# Concept - Index Header

Previous Next

## Overview

Every Index Record has a standard header and a set of blocks containing an Index Key and Index Data.

The size of an Index Record is defined in $Boot and always seems to be 4KB.

## Layout

### Standard Index Header

Offset | Size | Description
--- | --- | ---
0x00 | 4 | Magic number 'INDX'
0x04 | 2 | Offset to the Update Sequence
0x06 | 2 | Size in words of the Update Sequence Number & Array (S)
0x08 | 8 | $LogFile sequence number
0x10 | 8 | VCN of this INDX buffer in the Index Allocation
0x18 | 4 | Offset to the Index Entries (a)
0x1C | 4 | Size of Index Entries (a)
0x20 | 4 | Allocated size of the Index Entries (a)
0x24 | 1 | 1 if not leaf node (b)
0x25 | 3 | Padding (always zero)
0x28 | 2 | Update sequence
0x2A | 2S-2 | Update sequence array

    (a) These values are relative to 0x18

    (b) Has children

## Notes

### List of Common Indexes

Name | Index Of | Description
--- | --- | ---
$I30 | Filenames | Used by Directories
$SDH | Security Descriptors | $Secure
$SII | Security Ids | $Secure
$O | Object Ids | $ObjId
$O | Owner Ids | $Quota
$Q | Quotas | $Quota
$R | Reparse Points | $Reparse

### Other Information

There is no information contained in the Index Record describing what the index is storing (this is kept in the Index Root).

Copyright (C) Validate HTML Validate CSS