TAG: windows,NTFS,xp,ntfs,files

Chapter 3. NTFS Files
1. Overview
Everything on an NTFS volume is a file. There are two categories: Metadata and Normal. The Metadata files contain information about the volume and the Normal files contain your data.

1.1.    Layout of the Volume
Below is a table of files found on a Win2K volume (Key).

Ta...

TAG: windows,encrypt,NTFS,xp,ntfs,decrypt

You encrypt or decrypt a folder or file by setting the encryption property for folders and files just as you set any other attribute such as read-only, compressed, or hidden. If you encrypt a folder, all files and subfolders created in the encrypted folder are automatically encrypted. It is recommended that you encrypt at the folder level.

You can also encrypt or decrypt a file or f...

TAG: windows,NTFS,xp,ntfs,attribute

16. Attribute -$LOGGED_UTILITY_STREAM (0x100)
16.1. Overview
As defined in $AttrDef, this attribute has a no minimum size but a maximum of 65536 bytes.

16.2. Layout of the Attribute
As an attribute it's no different to a named data attribute Contents depend on the name of the $DATA stream

Table 2.40. Layout of the $LOGGED_UTILITY_STREAM (0x100) attribute

TAG: windows,NTFS,xp,ntfs,attribute

14. Attribute - $EA_INFORMATION (0xD0)
14.1. Overview
Used to implement under NTFS the HPFS extended attributes used by the information subsystem of OS/2 and OS/2 clients of Windows NT servers. This file attribute may be non-resident because its stream is likely to grow. As defined in $AttrDef, this attribute has a minimum and a maximum size of 8 bytes.

14.2. Layout of the ...

TAG: windows,NTFS,xp,ntfs,attribute

12. Attribute - $BITMAP (0xB0)
12.1. Overview
This file attribute is a sequence of bits, each of which represents the status of an entity.

As defined in $AttrDef, this attribute has a no minimum or maximum size.

12.2. Layout of the Attribute
This attribute is currently used in two places: indexes (e.g. directories), $M...

TAG: windows,NTFS,xp,ntfs,attribute

11. Attribute -$INDEX_ALLOCATION (0xA0)
11.1. Overview
This is the basic component of an index (e.g. a directory). This is the storage location for all sub-nodes of the B+ tree that implements an index (e.g. a directory). This file attribute is always non-resident.

As defined in $AttrDef, this attribute has a no minimum or maximum siz...

TAG: windows,NTFS,xp,ntfs,attribute

10. Attribute - $INDEX_ROOT (0x90)
10.1. Overview
This is the root node of the B+ tree that implements an index (e.g. a directory). This file attribute is always resident.

10.2. Layout of the Attribute
Link up below:

$INDEX_ROOT
  Standard Attribute Header
  Index Root
  Index Header
...

TAG: windows,NTFS,xp,ntfs,attribute

9. Attribute - $DATA (0x80)
9.1. Overview
This Attribute contains the file's data. A file's size is the size of its unnamed Data Stream. As defined in $AttrDef, this attribute has a no minimum or maximum size.

9.2. Layout of the Attribute
Table 2.23. Layout of the $DATA (0x80) attribute

TAG: windows,NTFS,xp,ntfs,attribute,volume

7. Attribute - $VOLUME_NAME (0x60)
7.1. Overview
This attribute simply contains the names of the volume. As defined in $AttrDef, this attribute has a minimum size of 2 bytes and a maximum of 256 bytes. This equates to a maximum volume name length of 127 Unicode characters.

7.2. Layout of the Attribute
Table 2.19. Layout of the $VOLUME_NAME (0x60) attribute

TAG: windows,NTFS,xp,ntfs,filesystem

Absolute, security descriptor doesn’t contain the owner and group SIDs, nor the sacl and dacl.

ACL's inside the security descriptor. Instead, it contains pointers to these structures in memory.

Obviously, absolute security descriptors are only useful for in memory representations of security descriptors. On disk, a self-relative security descriptor is used.  Attrib...