eric 
0 
2007-09-11 05:25:20 -04002.2. Layout of the Attribute (Resident)
Table 2.2. Layout of the $STANDARD_INFORMATION (0x10) attribute
| Offset | Size | OS | Description |
| ~ | ~ | Standard AttributeHeader | |
| 0x00 | 8 | C Time - File Creation | |
| 0x08 | 8 | A Time - File Altered | |
| 0x10 | 8 | M Time - MFT Changed | |
| 0x18 | 8 | R Time - File Read | |
| 0x20 | 4 | DOS File Permissions | |
| 0x24 | 4 | Maximum Number of Versions | |
| 0x28 | 4 | Version Number | |
| 0x2C | 4 | Class Id | |
| 0x30 | 4 | 2K | Owner Id |
| 0x34 | 4 | 2K | Security Id |
| 0x38 | 8 | 2K | Quota Charged |
| 0x40 | 8 | 2K | Update Sequence Number (USN) |
2.2.1. File Permissions
Also called attributes in DOS terminology.
Table 2.3. File Permissions
| Flag | Description |
| 0x0001 | Read-Only |
| 0x0002 | Hidden |
| 0x0004 | System |
| 0x0020 | Archive |
| 0x0040 | Device |
| 0x0080 | Normal |
| 0x0100 | Temporary |
| 0x0200 | Sparse File |
| 0x0400 | Reparse Point |
| 0x0800 | Compressed |
| 0x1000 | Offline |
| 0x2000 | Not Content Indexed |
| 0x4000 | Encrypted |
Trackback: http://blog.easeus.com/action.php?action=tb&id=37
Tags: windows,NTFS,xp,ntfs
