| Glossary |
The Root Directory of an NTFS, called .
(dot) is an ordinary
directory. If the volume has Reparse Points then the directory will
have a Named Data Stream called $MountMgrDatabase
. See the
Directory Page for more
information.
| Type | Description | Name |
|---|---|---|
| 0x10 | $STANDARD_INFORMATION | |
| 0x30 | $FILE_NAME | . |
| 0x50 | $SECURITY_DESCRIPTOR | |
| 0x80 | $DATA | $MountMgrDatabase |
| 0x90 | $INDEX_ROOT | $I30 |
| 0xA0 | $INDEX_ALLOCATION | $I30 |
| 0xB0 | $BITMAP | $I30 |
This Data Stream only exists when there are Reparse Points on the Volume. It consists of repeating groups of:
| Offset | Size | Description |
|---|---|---|
| 0x00 | 4 | Size of entry |
| 0x04 | 4 | Flags? (bitfield?) |
| 0x08 | 2 | Offset to UNC Path |
| 0x0A | 2 | Size of UNC Path |
| 0x0C | 2 | Offset to data |
| 0x0E | 2 | Size of data |
See the Directory Page for more information.