Attribute - $OBJECT_ID (0x40)

Previous Next


The Object Id was introduced in Windows 2000. Every MFT Record is assigned a unique GUID. Additionally, a record may have a Birth Volume Id, a Birth Object Id and a Domain Id, all of which are GUIDs.

As defined in $AttrDef, this attribute has a no minimum size but a maximum of 256 bytes.

Layout of the Attribute

Offset Size Name Description
~ ~ Standard Attribute Header  
0x00 16 GUID Object Id Unique Id assigned to file
0x10 16 GUID Birth Volume Id Volume where file was created
0x20 16 GUID Birth Object Id Original Object Id of file
0x30 16 GUID Domain Id Domain in which object was created

Birth Volume Id

Birth Volume Id is the Object Id of the Volume on which the Object Id was allocated. It never changes.

Birth Object Id

Birth Object Id is the first Object Id that was ever assigned to this MFT Record. I.e. If the Object Id is changed for some reason, this field will reflect the original value of the Object Id.

Domain Id

Domain Id is currently unused but it is intended to be used in a network environment where the local machine is part of a Windows 2000 Domain. This may be used in a Windows 2000 Advanced Server managed domain.


Other Information

This Attribute may be just 16 bytes long (the size of one GUID).

Even if the Birth Volume, Birth Object and Domain Ids are not used, they may be present, but one or more may be zero.

Need examples where all the fields are used.

Copyright ©