4. Attribute - $FILE_NAME (0x30)
4.1. Overview
This Attribute stores the name of the file attribute all is always resident.
As defined in $AttrDef, this attribute has a minimum size of 68 bytes and a maximum of 578 bytes. This equates to be a maximum filename length of 255 Unicode characters.

4.2. Layout of the Attribute (Resident)
Table 2.5. Layout of the $FILE_NAME (0x30) attribute

Offset	Size	Description
		Standard AttributeHeader
0x00	8	File reference to the parent directory.
0x08	8	C Time - File Creation
0x10	8	A Time - File Altered
0x18	8	M Time - MFT Changed
0x20	8	R Time - File Read
0x28	8	Allocated size of the file
0x30	8	Real size of the file
0x38	4	Flags, e.g. Directory, compressed, hidden
0x3c	4	Used by EAs and Reparse
0x40	1	Filename length in characters (L)
0x41	1	Filename namespace 0x422L File name in Unicode (not null terminated)

4.2.1. File Reference
This is a File Reference to the base record of the parent directory. The $FILE_NAME attribute is also defined to two parts. One is the standard Attribute Head. The other is Alterable Attribute Content. The structure of the head is the same the standard structure of the Head.

4.2.2. File Size
The allocated size of a file is the amount of disk space the file is taking up. It will be a multiple of the cluster size. The real size of the file is the size of the unnamed data attribute. This is the number that will appear in a directory listing.

The Real Size is only present if the Starting VCN is zero. See the Standard Attribute Headerfor more information.

Denomination Space is a sign which concern with which character can be used in the file name. For supporting the old application, NTFS distribute a friendly short DOS file name for each incompatible DOS file name.

Trackback: http://blog.easeus.com/action.php?action=tb&id=43

Tags: windows,NTFS,xp,ntfs,attribute