NTFS documents (9)

Fine Happy

Authoreric   Category Related Resource   Comments0   Post Time 2007-09-17 21:30:45 -0400

4.2.3. Flags
Table 2.6. File Flags

 Flag Description
 0x0001 Read-Only
 0x0002 Hidden
 0x0004 System
 0x0020 Archive
 0x0040 Device
 0x0080 Normal
 0x0100 Temporary
 0x0200 Sparse File
 0x0400 Reparse Point
 0x0800 Compressed
 0x1000 Offline
 0x2000 Not Content Indexed
 0x4000 Encrypted
 0x10000000 Directory (copy from corresponding bit in MFT record)
 0x20000000 Index View (copy from corresponding bit in MFT record)

4.3. Notes
4.3.1. Other Information
NTFS implements POSIX-style Hard Links by creating a file with several Filename Attributes. Each Filename Attribute has its own details and parent. When a Hard Linked file is deleted, its filename is removed from the MFT Record. When the last link is removed, then the file is really deleted.

All fields, except the parent directory, are only updated when the filename is changed. Until then, they just become out of date. $STANDARD_INFORMATIONAttribute, however, will always be kept up-to-date.

If the file has EAs (Extended Attributes), then the EA Field will contain the size of buffer needed.
If the file is a Reparse Point, then the Reparse Field will give its type.

5. Attribute - $OBJECT_ID (0x40)
5.1. Overview
The Object Id was introduced in Windows 2000. Every MFT Record is assigned a unique GUID. Additionally, a record may have a Birth Volume Id, a Birth Object Id and a Domain Id, all of which are GUIDs.

As defined in $AttrDef, this attribute has a no minimum size but a maximum of 256 bytes.

Trackback URL Trackback: http://blog.easeus.com/action.php?action=tb&id=45

Tags Tags: windows,NTFS,xp,ntfs,attribute,flags

Comments List

Post a Comment

  • Name:
  • Email:
  • HomePage:
  • Comment:
  • Question:

Home | Solution | About Company | Contacts | Resource | Blog | Forum | Directory | Links | Sitemap

Copyright © 2005-2008 CHENGDU YIWO Tech Development Co., Ltd. ALL RIGHTS RESERVED.

Privacy Policy | License | Legal Counsel