Glossary

File - $Quota (Any)

Previous Next

Overview

This file first appeared in Window NT, but wan't used. In Windows 2000, and later, it keeps track of file quotas. Quotas are kept per person and per volume.

Attributes

Type Description Name
0x10 $STANDARD_INFORMATION  
0x30 $FILE_NAME $Quota
0x90 $INDEX_ROOT $O
0x90 $INDEX_ROOT $Q
0xA0 $INDEX_ALLOCATION $O
0xA0 $INDEX_ALLOCATION $Q
0xB0 $BITMAP $O
0xB0 $BITMAP $Q

Layout of the File

$O Index

Offset Size Value Description
~ ~ ~ Index Entry
0x00 2 0x1C Offset to data
0x02 2 0x04 Size of data
0x04 4 0x00 Padding
0x08 2 0x20 Size of Index Entry
0x0A 2 0x0C Size of Index Key (K)
0x0C 2   Flags
0x0E 2 0x00 Padding
0x10 K   Key SID
K+0x10 4   Data Owner Id
K+0x14 P   Data Padding8
Flags?

$Q Index

header & repeating group
Offset Size Value Description
~ ~ ~ Standard Index Header
0x00 2 0x14 Offset to data
0x02 2   Size of data
0x04 4 0x00 Padding
0x08 2   Size of Index Entry
0x0A 2 0x04 Size of Index Key
0x0C 4 0x00 Padding
0x10 4   Key Owner Id
0x14 4 0x02 Data Version
0x18 4   Data Flags
0x1C 8   Data Bytes Used
0x24 8   Data Change Time
0x2C 8   Data Warning Limit
0x34 8   Data Hard Limit
0x3C 8   Data Exceeded Time
0x44 V   Data SID
V+0x44 P 0x00 Data Padding8
    sid may be missing (quota flags = default limit => no SID, just padding)
    padding may not be necessary
    index key - xref to which index?
    change time - date/time
    exceeded time - 10/4/01 (not +5 days)
    in the last (null) entry, the padding at 0x0C = 0x02
    

Flags

Flag Description
0x0001 Default Limits
0x0002 Limit Reached
0x0004 Id Deleted
0x0010 Tracking Enabled
0x0020 Enforcement Enabled
0x0040 Tracking Requested
0x0080 Log Threshold
0x0100 Log Limit
0x0200 Out Of Date
0x0400 Corrupt
0x0800 Pending Deletes

Notes

Other Information

The index is called $O. This is an index of Owner Ids. It should not be confused with the index of the same name, used by the Metadata File $ObjId.

A file's Owner Id is stored in the $STANDARD_INFORMATION Attribute. The Owner Id can be looked up in $O, to give a Security Id (SID) or looked up in $Q to provide quota information.

    The $Q index contains one entry for each existing user_id on the volume. The
    index key is the user_id of the user/group owning this quota control entry,
    i.e. the key is the owner_id. The user_id of the owner of a file, i.e. the
    owner_id, is found in the standard information attribute. The collation rule
    for $Q is COLLATION_NTOFS_ULONG.

    The $O index contains one entry for each user/group who has been assigned
    a quota on that volume. The index key holds the SID of the user_id the
    entry belongs to, i.e. the owner_id. The collation rule for $O is
    COLLATION_NTOFS_SID.

    The $O index entry data is the user_id of the user corresponding to the SID.
    This user_id is used as an index into $Q to find the quota control entry
    associated with the SID.
    

Copyright ©