07-10
21

NTFS DOCUTMENTS (21)

Cloudy Happy

Authoreric   Category Related Resource   Comments1   Post Time 2007-10-21 21:10:54 -0400

14. Attribute - $EA_INFORMATION (0xD0)
14.1. Overview
Used to implement under NTFS the HPFS extended attributes used by the information subsystem of OS/2 and OS/2 clients of Windows NT servers. This file attribute may be non-resident because its stream is likely to grow. As defined in $AttrDef, this attribute has a minimum and a maximum size of 8 bytes.

14.2. Layout of the Attribute
Table 2.37.    Layout of the $EA_INFORMATION (0xD0) attribute

 Offset Size Description
 ~ ~ Standard AttributeHeader
 0x00 2 Size of the packed Extended Attributes
 0x02 2 Number of Extended Attributes which have NEED_EA set
 0x04 4 Size of the unpacked Extended Attributes


This is just a general description. It is not very comprehensive. But we think we had described the most situation of $EA_INFORMATION. If you still unsatisfied with our description, we could only suggest you read more articles to find the situation.

15. Attribute - $EA (0xE0)
15.1. Overview
Used for implementing the HPFS extended attribute under NTFS. This file attribute may be non-resident because its stream is likely to grow. As defined in $AttrDef, this attribute has a no minimum size but a maximum of 65536 bytes.

15.2. Layout of the Attribute
The Extended Attribute is a collection of name, value pairs.

Table 2.38.  Layout of the $EA (0xE0) attribute
 Offset Size Description
 ~ ~ Standard AttributeHeader
 0x00 4 Offset to next Extended Attribute
 0x04 1 Flags
 0x05 1 Name Length (N)
 0x06 2 Value Length (V)
 0x08 N Name
 N+0x08 V Value


Conversely, the Offset to next EA is the size of this EA.

15.2.1. Flags
Table 2.39.  EA flags
 Value Description
 0x80 Need EA


15.3. Notes
15.3.1. Other Information
What are the role and the layout of the stream of this file attribute? It could be valuable to have a look at HPFS documentation.

15.3.2. Questions
Is it true that the EA name is not Unicode? We have to tell you that we are really not very clear this question. However, according to its behaving, we think it is Unicode. This is just our suspicion. If someone knows about this question, please let us know.

Trackback URL Trackback: http://blog.easeus.com/action.php?action=tb&id=76

Tags Tags: windows,NTFS,xp,ntfs,attribute

Comments List

AILSA posted on 2007-10-22 21:32:08 -0400

I only know NTFS is a kind of the file allocation table, and the file allocation table is that An area on a hard disk or floppy disk where information is stored about the physical location of each piece of every file on the disk and about the location of unusable areas of the disk.Now , I learn more about NTFS after reading your article thank you!

Post a Comment

  • Name:
  • Email:
  • HomePage:
  • Comment:
  • Question:

Home | Solution | About Company | Contacts | Resource | Blog | Forum | Directory | Links | Sitemap

Copyright © 2005-2008 CHENGDU YIWO Tech Development Co., Ltd. ALL RIGHTS RESERVED.

Privacy Policy | License | Legal Counsel