ATTRIBUTE_LIST_ENTRY structure

[This structure is valid only for version 3 of NTFS volumes; it may be altered in future versions.]

Represents an entry in the attribute list.

Syntax


typedef struct _ATTRIBUTE_LIST_ENTRY {
  ATTRIBUTE_TYPE_CODE   AttributeTypeCode;
  USHORT                RecordLength;
  UCHAR                 AttributeNameLength;
  UCHAR                 AttributeNameOffset;
  VCN                   LowestVcn;
  MFT_SEGMENT_REFERENCE SegmentReference;
  USHORT                Reserved;
  WCHAR                 AttributeName[1];
} ATTRIBUTE_LIST_ENTRY, *PATTRIBUTE_LIST_ENTRY;

Members

AttributeTypeCode

The attribute type code.

ValueMeaning
$STANDARD_INFORMATION
0x10

File attributes (such as read-only and archive), time stamps (such as file creation and last modified), and the hard link count.

$ATTRIBUTE_LIST
0x20

A list of attributes that make up the file and the file reference of the MFT file record in which each attribute is located.

$FILE_NAME
0x30

The name of the file, in Unicode characters.

$OBJECT_ID
0x40

An 16-byte object identifier assigned by the link-tracking service.

$VOLUME_NAME
0x60

The volume label. Present in the $Volume file.

$VOLUME_INFORMATION
0x70

The volume information. Present in the $Volume file.

$DATA
0x80

The contents of the file.

$INDEX_ROOT
0x90

Used to implement filename allocation for large directories.

$INDEX_ALLOCATION
0xA0

Used to implement filename allocation for large directories.

$BITMAP
0xB0

A bitmap index for a large directory.

$REPARSE_POINT
0xC0

The reparse point data.

 

RecordLength

The size of this structure, plus the optional name buffer, in bytes.

AttributeNameLength

The size of the optional attribute name, in characters. If a name exists, this value is nonzero and the structure is followed immediately by a Unicode string of the specified number of characters.

AttributeNameOffset

Reserved.

LowestVcn

The lowest virtual cluster number (VCN) for this attribute. This member is zero unless the attribute requires multiple file record segments and unless this entry is a reference to a segment other than the first one. In this case, this value is the lowest VCN that is described by the referenced segment.

SegmentReference

The master file table (MFT) segment in which the attribute resides. See MFT_SEGMENT_REFERENCE.

Reserved

Reserved.

AttributeName

The start of the optional attribute name.

Remarks

The attributes list is an ordered list of quadword-aligned ATTRIBUTE_LIST_ENTRY structures. This list is ordered first by the attribute type code and then by the attribute name (if present). No two attributes can have the same type code, name, and lowest VCN. Therefore, there can be at most one attribute for each type code without a name.

This structure definition is valid only for major version 3 and minor version 0 or 1, as reported by FSCTL_GET_NTFS_VOLUME_DATA.

Note that there is no associated header file for this structure.

See also

Master File Table

 

 

Show: