9. Attribute - $DATA (0x80)
9.1. Overview
This Attribute contains the file's data. A file's size is the size of its unnamed Data Stream. As defined in $AttrDef, this attribute has a no minimum or maximum size.

9.2. Layout of the Attribute
Table 2.23. Layout of the $DATA (0x80) attribute

Offset	Size Description
~ ~	Standard AttributeHeader
0x00	Any data

9.3. Notes
9.3.1. Common Data Stream Used By Windows
    [Unnamed]
    {4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
    ^EDocumentSummaryInformation
    ^ESebiesnrMkudrfcoIaamtykdDa
    ^ESummaryInformation
    $MountMgrDatabase
    $Bad
    $SDS
    $J
    $Max

These attribute is identified for some especially purpose in usual. When the users create the files, they will never use these attributes. Hence, we will not describe it in detail any more. We will just recount them in general.

9.3.2. Other Information
Usually, a directory has no Data Attribute, and the DataAttribute of a file has no name.

Must have (at least empty) unnamed data attr NTFS has an advantage: as you can have several data attributes for a file, you can easily implement HFS whose files are made of two parts (also called forks in the HFS terminology): a resource part and a data part. For the data part, you use default unnamed data attribute, and for the resource part, you use a data attribute named e.g. 'resource'.

Trackback: http://blog.easeus.com/action.php?action=tb&id=63

Tags: windows,NTFS,xp,ntfs,attribute