Glossary

Attribute - $STANDARD_INFORMATION (0x10)

Previous Next

Overview

In old version of NTFS this Attribute contained little more than the DOS File Permissions and the file times.

Windows 2000 introduced four new fields which are used to reference Quota, Security, File Size and Logging information.

As defined in $AttrDef, this attribute has a minimum size of 48 bytes and a maximum of 72 bytes.

Layout of the Attribute (Resident)

Offset Size OS Description
~ ~   Standard Attribute Header
0x00 8   C Time - File Creation
0x08 8   A Time - File Altered
0x10 8   M Time - MFT Changed
0x18 8   R Time - File Read
0x20 4   DOS File Permissions
0x24 4   Maximum Number of Versions
0x28 4   Version Number
0x2C 4   Class Id
0x30 4 2K Owner Id
0x34 4 2K Security Id
0x38 8 2K Quota Charged
0x40 8 2K Update Sequence Number (USN)

File Permissions

Also called attributes in DOS terminology.

Flag Description
0x0001 Read-Only
0x0002 Hidden
0x0004 System
0x0020 Archive
0x0040 Device
0x0080 Normal
0x0100 Temporary
0x0200 Sparse File
0x0400 Reparse Point
0x0800 Compressed
0x1000 Offline
0x2000 Not Content Indexed
0x4000 Encrypted
Maximum Number of Versions
Maximum allowed versions for file. Zero means that version numbering is disabled.
Version Number
This file's version (if any). Will be zero if Maximum Number of Versions is zero.
Class Id
Class Id from bidirectional Class Id index.
Owner Id
Owner Id of the user owning the file. This Id is a key in the $O and $Q Indexes of the file $Quota. If zero, then quotas are disabled.
Security Id
This should not be confused with a Security Identifier. The Security Id is a key in the $SII Index and $SDS Data Stream in the file $Secure.
Quota Charged
The number of bytes this file user from the user's quota. This should be the total data size of all streams. If zero, then quotas are disabled.
Update Sequence Number (USN)
Last Update Sequence Number of the file. This is a direct index into the file $UsnJrnl. If zero, the USN Journal is disabled.

Notes

Other Information

If a NTFS volume is upgraded from v1.2 to v3.0, then this attribute won't be upgraded (lengthened) until it is accesssed.

Questions

Are the Version fields and the Class Id ever used?


Copyright ©