Home
Files
Attributes
Concepts
 Glossary

File - $AttrDef (4)

Previous Next

Overview

This is a system file containing information about all the file attributes usable in a volume.

Attribute end marker 0xFFFFFFFF

Attributes

Type Description Name
0x10 $STANDARD_INFORMATION  
0x30 $FILE_NAME $AttrDef
0x50 $SECURITY_DESCRIPTOR  
0x80 $DATA [Unnamed]

Layout of the File

Unnamed Data Stream

Its layout is a sequence of records. Each record defines one file attribute, and its layout is:

Offset Size Description
0x00 128 Label in Unicode
0x80 4 Type
0x84 4 Display rule
0x88 4 Collation rule
0x8C 4 Flags
0x90 8 Minimum size
0x98 8 Maximum size

Notes

Display Rule
At the moment this is always zero
Collation Rule
At the moment this is always zero, but the possible values are:
Flag Description
0x00 Binary
0x01 Filename
0x02 Unicode String
0x10 Unsigned Long
0x11 SID
0x12 Security Hash
0x13 Multiple Unsigned Longs
Flags
We've only witnessed three flags: 0x02, 0x40 and 0x80. It seems that 0x40 and 0x80 are never seen together. Therefore, the guess is that:
Flag Description
0x02 Indexed
0x40 Resident (always)
0x80 Non-Resident (allowed to be)
See the column IRN in the tables below.

Windows NT Example

Type Name Flags IRN Min Size Max Size
0x10 $STANDARD_INFORMATION 0x40 R 0x30 0x30
0x20 $ATTRIBUTE_LIST 0x80 N - -
0x30 $FILE_NAME 0x42 IR 0x44 0x242
0x40 $VOLUME_VERSION 0x40 R 0x8 0x8
0x50 $SECURITY_DESCRIPTOR 0x80 N - -
0x60 $VOLUME_NAME 0x40 R 0x2 0x100
0x70 $VOLUME_INFORMATION 0x40 R 0xC 0xC
0x80 $DATA 0x00   - -
0x90 $INDEX_ROOT 0x40 R - -
0xA0 $INDEX_ALLOCATION 0x80 N - -
0xB0 $BITMAP 0x80 N - -
0xC0 $SYMBOLIC_LINK 0x80 N - -
0xD0 $EA_INFORMATION 0x40 R 0x8 0x8
0xE0 $EA 0x00   - 0x10000

$VOLUME_VERSION and $SYMBOLIC_LINK appeared in WinNT but weren't used. They don't appear in either Win2K or WinXP.

Windows 2000 and Windows XP Example

Type Name Flags IRN Min Size Max Size
0x10 $STANDARD_INFORMATION 0x40 R 0x30 0x48
0x20 $ATTRIBUTE_LIST 0x80 N - -
0x30 $FILE_NAME 0x42 IR 0x44 0x242
0x40 $OBJECT_ID 0x40 R - 0x100
0x50 $SECURITY_DESCRIPTOR 0x80 N - -
0x60 $VOLUME_NAME 0x40 R 0x2 0x100
0x70 $VOLUME_INFORMATION 0x40 R 0xC 0xC
0x80 $DATA 0x00   - -
0x90 $INDEX_ROOT 0x40 R - -
0xA0 $INDEX_ALLOCATION 0x80 N - -
0xB0 $BITMAP 0x80 N - -
0xC0 $REPARSE_POINT 0x80 N - 0x4000
0xD0 $EA_INFORMATION 0x40 R 0x8 0x8
0xE0 $EA 0x00   - 0x10000
0xF0 $PROPERTY_SET ? ? ? ?
0x100 $LOGGED_UTILITY_STREAM 0x80 N - 0x10000

$PROPERTY_SET existed, briefly, in NTFS v3.0. It was intended to support Native Structure Storage (NSS).

Other Information

It should be possible to add user-defined attributes to this file.

    $AttrDef has big WAS it? 36K?
    yep in nt4 = 36K mostly blank
    now 2560 = 15attrs + 1 blank (2.5K)

Copyright ©