4.2.3. Flags
Table 2.6. File Flags

Flag	Description
0x0001	Read-Only
0x0002	Hidden
0x0004	System
0x0020	Archive
0x0040	Device
0x0080	Normal
0x0100	Temporary
0x0200	Sparse File
0x0400	Reparse Point
0x0800	Compressed
0x1000	Offline
0x2000	Not Content Indexed
0x4000	Encrypted
0x10000000	Directory (copy from corresponding bit in MFT record)
0x20000000	Index View (copy from corresponding bit in MFT record)

4.3. Notes
4.3.1. Other Information
NTFS implements POSIX-style Hard Links by creating a file with several Filename Attributes. Each Filename Attribute has its own details and parent. When a Hard Linked file is deleted, its filename is removed from the MFT Record. When the last link is removed, then the file is really deleted.

All fields, except the parent directory, are only updated when the filename is changed. Until then, they just become out of date. $STANDARD_INFORMATIONAttribute, however, will always be kept up-to-date.

If the file has EAs (Extended Attributes), then the EA Field will contain the size of buffer needed.
If the file is a Reparse Point, then the Reparse Field will give its type.

5. Attribute - $OBJECT_ID (0x40)
5.1. Overview
The Object Id was introduced in Windows 2000. Every MFT Record is assigned a unique GUID. Additionally, a record may have a Birth Volume Id, a Birth Object Id and a Domain Id, all of which are GUIDs.

As defined in $AttrDef, this attribute has a no minimum size but a maximum of 256 bytes.

Trackback: http://blog.easeus.com/action.php?action=tb&id=45

Tags: windows,NTFS,xp,ntfs,attribute,flags