07-10
08

NTFS DOCUMENTS (20)

Overcast Happy

Authoreric   Category Related Resource   Comments0   Post Time 2007-10-08 21:59:56 -0400

12. Attribute - $BITMAP (0xB0)
12.1. Overview
This file attribute is a sequence of bits, each of which represents the status of an entity.

As defined in $AttrDef, this attribute has a no minimum or maximum size.

12.2. Layout of the Attribute
This attribute is currently used in two places: indexes (e.g. directories), $MFT. The index entries and the FILE records also have flags in them to show if they are in use or not.

In an index, the bit field shows which index entries are in use. Each bit represents one VCN of the index allocation.

In the $MFT, the bit field shows which FILE records are in use.

Table 2.31. Layout of the $BITMAP (0xB0) attribute

 Offset Size Description
 ~ ~ Standard AttributeHeader
 0x00  Bit field
 

We have described this attribute before. If you forget the description, you can find what we had described in foregoing page.

13. Attribute - $REPARSE_POINT(0xC0)

13.1. Overview

As defined in $AttrDef, this attribute has a no minimum size but a maximum of 16384 bytes.

13.2. Layout of the Attribute (Microsoft Reparse Point)

Table 2.32. Layout of the $REPARSE_POINT (0xC0) attribute (Microsoft Reparse Point)
 Offset Size Description
 ~ ~ Standard AttributeHeader
 0x00 4 Reparse Type (and Flags)
 0x04 2 Reparse Data Length
 0x06 2 Padding (align to 8 bytes)
 0x08 V Reparse Data (a)
 

13.3. Layout of the Attribute (Third-Party Reparse Point)

Table 2.33. Layout of the $REPARSE_POINT (0xC0) attribute (Third-Party Reparse Point)
 Offset Size Description
 ~ ~ Standard AttributeHeader
 0x00 4 Reparse Type (and Flags)
 0x04 2 Reparse Data Length
 0x06 2 Padding (align to 8 bytes)
 0x08 16 Reparse GUID
 0x18 V Reparse Data (a)
 

(a) The structureure of the Reparse Data depends on the Reparse Type. There are three defined Reparse Data (SymLinks, VolLinks and RSS) + the Generic Reparse.

13.3.1. Symbolic Link Reparse Data

Table 2.34. Symbolic Link Reparse Data
 Offset Size Description
 0x00 2 Substitute Name Offset
 0x02 2 Substitute Name Length
 0x04 2 Print Name Offset
 0x08 2 Print Name Length
 0x10 V Path Buffer
 

13.3.2. Volume Link Reparse Data

Table 2.35. Volume Link Reparse Data
 Offset Size Description
 0x00 2 Substitute Name Offset
 0x02 2 Substitute Name Length
 0x04 2 Print Name Offset
 0x08 2 Print Name Length
 0x10 V Path Buffer
 

13.3.3.Reparse Tag Flags

These are just the predefined reparse flags

Table 2.36. Reparse Tag Flags
 Flag Description
 0x20000000 Is alias
 0x40000000 Is high latency
 0x80000000 Is Microsoft
 0x68000005 NSS
 0x68000006 NSS recover
 0x68000007 SIS
 0x68000008 DFS
 0x88000003 Mount point
 0xA8000004 HSM
 0xE8000000 Symbolic link
 

13.4. Notes

13.4.1. Other Information

The reparse point tag defines the type of the reparse point. It also   includes several flags, which further describe the reparse point. The reparse point tag is an unsigned 32-bit value divided in three parts:   
1. The least significant 16 bits (i.e. bits 0 to 15) specify the type of the reparse point.

2. The 13 bits after this (i.e. bits 16 to 28) are reserved for future use.   

3. the most significant three bits are flags describing the reparse point. They are defined as follows:

bit 29: Name surrogate bit. If set, the filename is an alias for another object in the system.

bit 30: High-latecny bit. If set, accessing the first byte of data will be slow. (E.g. the data is stored on a tape drive.)  

bit 31: Microsoft bit. If set, the tag is owned by Microsoft. User defined tags have to use zero here.   The system file FILE_$Extend/$Reparse contains an index named $R listing all reparse points on the volume. The index entry keys are as defined below.

Note, that there is no index data associated with the index entries. The index entries are sorted by the index key file_id. The collation rule is COLLATION_NTOFS_ULONGS. FIXME: Verify whether the reparse_tag is not the primary key / is not a key at all. (AIA)

We describe two attributes in this article, and we will describe more attributes. These attributes are very important in the data recovery field. If you read these attributes without understanding, you can read more information about these attributes at our website. And if you are our customer, once you have problem in these attributes, we will give you an exact description and details for these attributes. Of course, the solution is what we must offer to you.

Trackback URL Trackback: http://blog.easeus.com/action.php?action=tb&id=67

Tags Tags: windows,NTFS,xp,ntfs,attribute

Comments List

Post a Comment

  • Name:
  • Email:
  • HomePage:
  • Comment:
  • Question:

Home | Solution | About Company | Contacts | Resource | Blog | Forum | Directory | Links | Sitemap

Copyright © 2005-2008 CHENGDU YIWO Tech Development Co., Ltd. ALL RIGHTS RESERVED.

Privacy Policy | License | Legal Counsel