NTFS Attributes
As I mentioned earlier, the MFT is a database. The records in this database contain attributes that describe elements of the file system such as files, directories, filenames, and so forth. These attributes are defined by the $AttrDef metadata record. Each attribute is given a code number that identifies it in the MFT records.
Following is a brief description of each attribute. If you would like to see this list in a production file system, the attributes are defined in the $Attribute metadata record. You can't see this record from the operating system shell, but you can scan the NTFS volume using a hex editor and search for any of the attribute names. Remember that they are prefixed with a dollar sign ($).
Header. The first ...
Get Inside Windows® Server 2003 now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
