Index Record - Concept - NTFS Documentation
Description: NTFS Documentation

Home | Files | Attributes | Concepts | Glossary

# Concept - Index Record

Previous Next

## Overview

    This is only applicable to a file index ($I30)

        indx help describe as "index = key + data"

        given an INDX record, it's difficult to work out what's
        being indexed (that info is in the index root)

## Definition

This is a sub-node of the B+ tree that implements an index (e.g. a directory). It is stored in the stream of the index allocation attribute associated to the index it belongs to.

## Layout

An INDX buffer is at least 2 KB large or the cluster size if larger (this seems to be a per-index parameter). It falls into 2 parts:

### The header part

this ISN'T just the header...

Offset | Size | Description
--- | --- | ---
~ | ~ | Standard Index Header
0x00 | 8 | MFT Reference of the file
0x08 | 2 | Size of this index entry
0x0A | 2 | Offset to the filename
0x0C | 2 | Index Flags
0x0E | 2 | Padding (align to 8 bytes)
0x10 | 8 | MFT File Reference of the parent
0x18 | 8 | File creation time
0x20 | 8 | Last modification time
0x28 | 8 | Last modification time for FILE record
0x30 | 8 | Last access time
0x38 | 8 | Allocated size of file
0x40 | 8 | Real size of file
0x48 | 8 | File Flags
0x50 | 1 | Length of filename (F)
0x51 | 1 | Filename namespace
0x52 | 2F | Filename
2F+0x52 | P | Padding (align to 8 bytes)
P+2F+0x52 | 8 | VCN of index buffer with sub-nodes

        N.B. the filename is not null terminated
        surely the flags can't be 8 bytes long
        table for the flags
        VCN of ib only exists when flags&1
        last entry has a size of 0x10 (just large enough
        for the flags (and a mft ref of zero))

### The sequence of index entries part

This is a sequence of index entries similar to the one found in the index root attribute.

The index entry has the following structure:

        Index entry flags (16-bit).

        INDEX_ENTRY_NODE = cpu_to_le16(1), This entry contains a sub-node,
                          i.e. a reference to an index
                          block in form of a virtual
                          cluster number (see below).
        INDEX_ENTRY_END  = cpu_to_le16(2), This signifies the last entry in
                          an index block. The index entry
                          does not represent a file but it
                          can point to a sub-node.

        This is an index entry. A sequence of such entries follows each INDEX_HEADER
        structure. Together they make up a complete index. The index follows either
        an index root attribute or an index allocation attribute.

        NOTE: Before NTFS 3.0 only filename attributes were indexed.

Most entries are not valid (and present) if the entry is the last one. This entry does not represent a file and is used only for subnodes. The pointer to the subnode buffer is only present if the entry has subnodes.

Copyright (C) Validate HTML Validate CSS