Attribute - Concept - NTFS Documentation
Description: NTFS Documentation

Home | Files | Attributes | Concepts | Glossary

# Concept - Attribute Header

Previous Next

## Overview

Every attribute in every MFT record has a standard header. The header stores information about the attribute's type, size, name (optional) and whether it is resident, or not.

The size of the attribute depends on two things. Does it have a name? Is it resident? To simplify the tables, all four possibilities will be shown in full (with some values already filled in).

## Standard Attribute Header

### Resident, No Name

Offset | Size | Value | Description
--- | --- | --- | ---
0x00 | 4 |  | Attribute Type (e.g. 0x10, 0x60)
0x04 | 4 |  | Length (including this header)
0x08 | 1 | 0x00 | Non-resident flag
0x09 | 1 | 0x00 | Name length
0x0A | 2 | 0x00 | Offset to the Name
0x0C | 2 | 0x00 | Flags
0x0E | 2 |  | Attribute Id (a)
0x10 | 4 | L | Length of the Attribute
0x14 | 2 | 0x18 | Offset to the Attribute
0x16 | 1 |  | Indexed flag
0x17 | 1 | 0x00 | Padding
0x18 | L |  | The Attribute

(a) Each attribute has a unique identifier

### Resident, Named

Offset | Size | Value | Description
--- | --- | --- | ---
0x00 | 4 |  | Attribute Type (e.g. 0x90, 0xB0)
0x04 | 4 |  | Length (including this header)
0x08 | 1 | 0x00 | Non-resident flag
0x09 | 1 | N | Name length
0x0A | 2 | 0x18 | Offset to the Name
0x0C | 2 | 0x00 | Flags
0x0E | 2 |  | Attribute Id (a)
0x10 | 4 | L | Length of the Attribute
0x14 | 2 | 2N+0x18 | Offset to the Attribute (b)
0x16 | 1 |  | Indexed flag
0x17 | 1 | 0x00 | Padding
0x18 | 2N | Unicode | The Attribute's Name
2N+0x18 | L |  | The Attribute (c)

(a) Resident attributes cannot be compressed
(b) Each attribute has a unique identifier
(c) Rounded up to a multiple of 4 bytes

### Non-Resident, No Name

Offset | Size | Value | Description
--- | --- | --- | ---
0x00 | 4 |  | Attribute Type (e.g. 0x20, 0x80)
0x04 | 4 |  | Length (including this header)
0x08 | 1 | 0x01 | Non-resident flag
0x09 | 1 | 0x00 | Name length
0x0A | 2 | 0x00 | Offset to the Name
0x0C | 2 |  | Flags
0x0E | 2 |  | Attribute Id (a)
0x10 | 8 |  | Starting VCN
0x18 | 8 |  | Last VCN
0x20 | 2 | 0x40 | Offset to the Data Runs
0x22 | 2 |  | Compression Unit Size (b)
0x24 | 4 | 0x00 | Padding
0x28 | 8 |  | Allocated size of the attribute (c)
0x30 | 8 |  | Real size of the attribute
0x38 | 8 |  | Initialized data size of the stream (d)
0x40 | ... |  | Data Runs

(a) Each attribute has a unique identifier
(b) Compression unit size = 2x clusters. 0 implies uncompressed
(c) This is the attribute size rounded up to the cluster size
(d) When is this not equal to the allocated size?

### Non-Resident, Named

Offset | Size | Value | Description
--- | --- | --- | ---
0x00 | 4 |  | Attribute Type (e.g. 0x80, 0xA0)
0x04 | 4 |  | Length (including this header)
0x08 | 1 | 0x01 | Non-resident flag
0x09 | 1 | N | Name length
0x0A | 2 | 0x40 | Offset to the Name
0x0C | 2 |  | Flags
0x0E | 2 |  | Attribute Id (a)
0x10 | 8 |  | Starting VCN
0x18 | 8 |  | Last VCN
0x20 | 2 | 2N+0x40 | Offset to the Data Runs (b)
0x22 | 2 |  | Compression Unit Size (c)
0x24 | 4 | 0x00 | Padding
0x28 | 8 |  | Allocated size of the attribute (d)
0x30 | 8 |  | Real size of the attribute
0x38 | 8 |  | Initialized data size of the stream (e)
0x40 | 2N | Unicode | The Attribute's Name
2N+0x40 | ... |  | Data Runs (b)

(a) Each attribute has a unique identifier
(b) Rounded up to a multiple of 4 bytes
(c) Compression unit size = 2x clusters. 0 implies uncompressed
(d) This is the attribute size rounded up to the cluster size
(e) When is this not equal to the allocated size?

## Flags

Flag | Description
--- | ---
0x0001 | Compressed
0x4000 | Encrypted
0x8000 | Sparse

## Notes

### Other Information

Only the data attribute can be compressed, or sparse, and only when it is non-resident.

Although the compression flag is stored in the header, it does not affect the size of the header.

        name isn't null terminated

        FIXME
        0x40 __s64 compressed_size;
        Byte size of the attribute value after compression.
        Only present when compressed. Always is a multiple of the cluster
        size. Represents the actual amount of disk space being used on the disk.

FIXME: The indexed flag only appears in the resident attributes. Does this mean you can only index resident attributes?

Copyright (C) Validate HTML Validate CSS