Concept - File

Overview

It is composed of attributes including its name and its data.

Attributes

Standard Information

This contains the DOS-style file permission, such as read-only and archive. It also contains four different types of modification time.

• File creation time
• Last modification time
• Last modification time for FILE record
• Last access time

File Name

The file's name is stored as an attribute, too. A file can have several filenames. This is Windows' equivalent to hard linking files together.

Security Descriptor

This stores all of Windows' permissions. ACLs, ACEs, auditing.

    May not exist on Win2K (std info, $secure)
    

Data

This, finally, is the actual data of the file. It, too, is stored in an attribute

    unnamed data stream compulsory (chkdsk will put it back if missing)
    named data streams optional (any limit to the number?)
    

Named Data Streams

    access with "jim.txt:stream"
    

Summary Information

Windows 2000 introduced the idea of summary information on files. This information is stored as a set of four named data streams.

Description

Title

Subject

Category

Keywords (multi-line)

Comments (multi-line)

Origin

Source

Author

Revision Number

N.B. Three of the names begin with CTRL-E (0x05). This is probably to discourage people from reading the streams directly.

The first stream {4c.. is always empty. This is probably just a marker to