11.2 NTFS Attribute Types
On a NTFS volume, each unit of information associated with a file including its name, its owner, its timestamp, its contents, and so on, is implemented as a file attribute. A file's data is an attribute; the "Data Attribute" known as $DATA. A number of attributes exist on a NTFS volume. The attribute names used by NTFS are listed in the table below.
|
Attribute Name |
Description |
|
$ATTRIBUTE_LIST |
Lists the location of all attribute records that do not fit in the MFT record |
|
$BITMAP |
Attribute for Bitmaps |
|
$DATA |
Contains default file data |
|
$EA |
Extended attribute index |
|
$EA_INFORMATION |
Extended attribute information |
|
$FILE_NAME |
File name |
|
$INDEX_ALLOCATION |
The type name for a Directory Stream. A string for the attribute code for index allocation |
|
$INDEX_ROOT |
Used to support folders and other indexes |
|
$LOGGED_UTILITY_STREAM |
Use by the encrypting file system |
|
$OBJECT_ID |
Unique GUID for every MFT record |
|
$PROPERTY_SET |
Obsolete |
|
$REPARSE_POINT |
Used for volume mount points |
|
$SECURITY_DESCRIPTOR |
|
|
$STANDARD_INFORMATION |
Standard information such as file times and quota data |
|
$SYMBOLIC_LINK |
Obsolete |
|
$TXF_DATA |
Transactional NTFS data |
|
$VOLUME_INFORMATION |
Version and state of the volume |
|
$VOLUME_NAME |
Name of the volume |
|
$VOLUME_VERSION |
Obsolete. Volume version |
A comprehensive discussion and explanation on attributes is available in [WININTERNALS] chapter 12 and [MSFT-NTFSWorks].
