16. Attribute -$LOGGED_UTILITY_STREAM (0x100)
16.1. Overview
As defined in $AttrDef, this attribute has a no minimum size but a maximum of 65536 bytes.

16.2. Layout of the Attribute
As an attribute it's no different to a named data attribute Contents depend on the name of the $DATA stream

Table 2.40. Layout of the $LOGGED_UTILITY_STREAM (0x100) attribute

Offset	Size	Description
~	~	Standard AttributeHeader
0x00		Any data

16.3. Notes
16.3.1. Other Information
Information needed
Operations on this attribute are logged to the journal ($LogFile) like normal metadata changes. Used by the Encrypting File System (EFS). All encrypted files have this attribute with the name $EFS. Can be anything the creator chooses.
 
EFS uses it as follows:   
FIXME: Type this info, verifying it along the way. (AIA)

Notes: Do you know what EFS is? If not, we will introduce what the EFS is to you in general. If you know what the EFS is, you can skip this notes.

Encrypting File System (EFS) provides the core file encryption technology used to store encrypted files on NTFS file system volumes. Once you encrypt a file or folder, you work with the encrypted file or folder just as you do with any other files and folders.

Encryption is transparent to the user that encrypted the file. This means that you do not have to manually decrypt the encrypted file before you can use it. You can open and change the file as you normally do.

Using EFS is similar to using permissions on files and folders. Both methods can be used to restrict access to data. However, an intruder who gains unauthorized physical access to your encrypted files or folders will be prevented from reading them. If the intruder tries to open or copy your encrypted file or folder he receives an access denied message. Permissions on files and folders do not protect against unauthorized physical attacks.

Trackback: http://blog.easeus.com/action.php?action=tb&id=77

Tags: windows,NTFS,xp,ntfs,attribute