12. Attribute - $BITMAP (0xB0)
12.1. Overview
This file attribute is a sequence of bits, each of which represents the status of an entity.

As defined in $AttrDef, this attribute has a no minimum or maximum size.

12.2. Layout of the Attribute
This attribute is currently used in two places: indexes (e.g. directories), $MFT. The index entries and the FILE records also have flags in them to show if they are in use or not.

In an index, the bit field shows which index entries are in use. Each bit represents one VCN of the index allocation.

In the $MFT, the bit field shows which FILE records are in use.

Table 2.31. Layout of the $BITMAP (0xB0) attribute

Offset	Size	Description
~	~	Standard AttributeHeader
0x00		Bit field

 

We have described this attribute before. If you forget the description, you can find what we had described in foregoing page.

13. Attribute - $REPARSE_POINT(0xC0)

13.1. Overview

As defined in $AttrDef, this attribute has a no minimum size but a maximum of 16384 bytes.

13.2. Layout of the Attribute (Microsoft Reparse Point)

Table 2.32. Layout of the $REPARSE_POINT (0xC0) attribute (Microsoft Reparse Point)

Offset	Size	Description
~	~	Standard AttributeHeader
0x00	4	Reparse Type (and Flags)
0x04	2	Reparse Data Length
0x06	2	Padding (align to 8 bytes)
0x08	V	Reparse Data (a)

 

13.3. Layout of the Attribute (Third-Party Reparse Point)

Table 2.33. Layout of the $REPARSE_POINT (0xC0) attribute (Third-Party Reparse Point)

Offset	Size	Description
~	~	Standard AttributeHeader
0x00	4	Reparse Type (and Flags)
0x04	2	Reparse Data Length
0x06	2	Padding (align to 8 bytes)
0x08	16	Reparse GUID
0x18	V	Reparse Data (a)

 

(a) The structureure of the Reparse Data depends on the Reparse Type. There are three defined Reparse Data (SymLinks, VolLinks and RSS) + the Generic Reparse.

13.3.1. Symbolic Link Reparse Data

Table 2.34. Symbolic Link Reparse Data

Offset	Size	Description
0x00	2	Substitute Name Offset
0x02	2	Substitute Name Length
0x04	2	Print Name Offset
0x08	2	Print Name Length
0x10	V	Path Buffer

 

13.3.2. Volume Link Reparse Data

Table 2.35. Volume Link Reparse Data

Offset	Size	Description
0x00	2	Substitute Name Offset
0x02	2	Substitute Name Length
0x04	2	Print Name Offset
0x08	2	Print Name Length
0x10	V	Path Buffer

 

13.3.3.Reparse Tag Flags

These are just the predefined reparse flags

Table 2.36. Reparse Tag Flags

Flag	Description
0x20000000	Is alias
0x40000000	Is high latency
0x80000000	Is Microsoft
0x68000005	NSS
0x68000006	NSS recover
0x68000007	SIS
0x68000008	DFS
0x88000003	Mount point
0xA8000004	HSM
0xE8000000	Symbolic link

 

13.4. Notes

13.4.1. Other Information

The reparse point tag defines the type of the reparse point. It also   includes several flags, which further describe the reparse point. The reparse point tag is an unsigned 32-bit value divided in three parts:   
1. The least significant 16 bits (i.e. bits 0 to 15) specify the type of the reparse point.

2. The 13 bits after this (i.e. bits 16 to 28) are reserved for future use.   

3. the most significant three bits are flags describing the reparse point. They are defined as follows:

bit 29: Name surrogate bit. If set, the filename is an alias for another object in the system.

bit 30: High-latecny bit. If set, accessing the first byte of data will be slow. (E.g. the data is stored on a tape drive.)  

bit 31: Microsoft bit. If set, the tag is owned by Microsoft. User defined tags have to use zero here.   The system file FILE_$Extend/$Reparse contains an index named $R listing all reparse points on the volume. The index entry keys are as defined below.

Note, that there is no index data associated with the index entries. The index entries are sorted by the index key file_id. The collation rule is COLLATION_NTOFS_ULONGS. FIXME: Verify whether the reparse_tag is not the primary key / is not a key at all. (AIA)

We describe two attributes in this article, and we will describe more attributes. These attributes are very important in the data recovery field. If you read these attributes without understanding, you can read more information about these attributes at our website. And if you are our customer, once you have problem in these attributes, we will give you an exact description and details for these attributes. Of course, the solution is what we must offer to you.

Trackback: http://blog.easeus.com/action.php?action=tb&id=67

Tags: windows,NTFS,xp,ntfs,attribute