eric 
1 
2007-10-21 21:10:54 -040014. Attribute - $EA_INFORMATION (0xD0)
14.1. Overview
Used to implement under NTFS the HPFS extended attributes used by the information subsystem of OS/2 and OS/2 clients of Windows NT servers. This file attribute may be non-resident because its stream is likely to grow. As defined in $AttrDef, this attribute has a minimum and a maximum size of 8 bytes.
14.2. Layout of the Attribute
Table 2.37. Layout of the $EA_INFORMATION (0xD0) attribute
| Offset | Size | Description |
| ~ | ~ | Standard AttributeHeader |
| 0x00 | 2 | Size of the packed Extended Attributes |
| 0x02 | 2 | Number of Extended Attributes which have NEED_EA set |
| 0x04 | 4 | Size of the unpacked Extended Attributes |
This is just a general description. It is not very comprehensive. But we think we had described the most situation of $EA_INFORMATION. If you still unsatisfied with our description, we could only suggest you read more articles to find the situation.
15. Attribute - $EA (0xE0)
15.1. Overview
Used for implementing the HPFS extended attribute under NTFS. This file attribute may be non-resident because its stream is likely to grow. As defined in $AttrDef, this attribute has a no minimum size but a maximum of 65536 bytes.
15.2. Layout of the Attribute
The Extended Attribute is a collection of name, value pairs.
Table 2.38. Layout of the $EA (0xE0) attribute
| Offset | Size | Description |
| ~ | ~ | Standard AttributeHeader |
| 0x00 | 4 | Offset to next Extended Attribute |
| 0x04 | 1 | Flags |
| 0x05 | 1 | Name Length (N) |
| 0x06 | 2 | Value Length (V) |
| 0x08 | N | Name |
| N+0x08 | V | Value |
Conversely, the Offset to next EA is the size of this EA.
15.2.1. Flags
Table 2.39. EA flags
| Value | Description |
| 0x80 | Need EA |
15.3. Notes
15.3.1. Other Information
What are the role and the layout of the stream of this file attribute? It could be valuable to have a look at HPFS documentation.
15.3.2. Questions
Is it true that the EA name is not Unicode? We have to tell you that we are really not very clear this question. However, according to its behaving, we think it is Unicode. This is just our suspicion. If someone knows about this question, please let us know.
Trackback: http://blog.easeus.com/action.php?action=tb&id=76
Tags: windows,NTFS,xp,ntfs,attribute
