Attribute - $STANDARD_INFORMATION (0x10)

Overview

In old version of NTFS this Attribute contained little more than the DOS File Permissions and the file times.

Windows 2000 introduced four new fields which are used to reference Quota, Security, File Size and Logging information.

As defined in $AttrDef, this attribute has a minimum size of 48 bytes and a maximum of 72 bytes.

Offset	Size	OS	Description
~	~		Standard Attribute Header
0x00	8		C Time - File Creation
0x08	8		A Time - File Altered
0x10	8		M Time - MFT Changed
0x18	8		R Time - File Read
0x20	4		DOS File Permissions
0x24	4		Maximum Number of Versions
0x28	4		Version Number
0x2C	4		Class Id
0x30	4	2K	Owner Id
0x34	4	2K	Security Id
0x38	8	2K	Quota Charged
0x40	8	2K	Update Sequence Number (USN)

Also called attributes in DOS terminology.

Maximum Number of Versions: Maximum allowed versions for file. Zero means that version numbering is disabled.
Version Number: This file's version (if any). Will be zero if Maximum Number of Versions is zero.
Class Id: Class Id from bidirectional Class Id index.
Owner Id: Owner Id of the user owning the file. This Id is a key in the $O and $Q Indexes of the file $Quota. If zero, then quotas are disabled.
Security Id: This should not be confused with a Security Identifier. The Security Id is a key in the $SII Index and $SDS Data Stream in the file $Secure.
Quota Charged: The number of bytes this file user from the user's quota. This should be the total data size of all streams. If zero, then quotas are disabled.
Update Sequence Number (USN): Last Update Sequence Number of the file. This is a direct index into the file $UsnJrnl. If zero, the USN Journal is disabled.

If a NTFS volume is upgraded from v1.2 to v3.0, then this attribute won't be upgraded (lengthened) until it is accesssed.

Are the Version fields and the Class Id ever used?