NTFS standard two

 

 

>=64 bytes
 
Note
1. Only data (Data) non-resident property can be compressed or sparse type.
2. Only resident property only index mark, does it mean that only resident property can be indexed?
 
STANDARD_INFORMATION (0x10 resident property len = 0x30, 0x48)
In older versions of NTFS, STARDAND_INFORMATION property only for the time and DOS file attribute information stored in the file. In Windows 2000, the introduction of four new fields to describe the quotas, security, file size, and log information.
Property described in the following table:

Name
Offset
Size
Description
 
-
-
Standard attribute header (24 bytes)
SI_CreatTime
0x00
8
File creation time
SI_AlterTime
0x08
8
Last file modification time
SI_MFTChgTime
0x10
8
MFT record file modification time
SI_ReadTime
0x18
8
Last access time
SI_DOSAttr
0x20
4
DOS file attribute may be a combination of the following values:
0x0001     read only
0x0002     hide
0x0004     System
0x0020     Archive
0x0040     Device
0x0080     routine
0x0100     temporary files
0x0200     sparse file
0x0400     reparse points
0x0800     compression
0x1000     Offline
0x2000     No content index
0x4000     encryption
SI_MaxVer
0x24
4
Maximum file version numbers available, this value of 0 indicates the version function is disabled (currently not in use?)
SI_Ver
0x28
4
File version number, if the maximum version number is 0 value must be 0
SI_ClassId
0x2c
4
Unknown (currently not in use?)
SI_OwnerId
0x30
4(2K)
File owner ID, the ID is $ Quota file $ O or $ Q record button, if the value 0 indicates quota settings are disabled
SI_SecurityId
0x34
4(2K)
Security ID, the value is $ Securce file index $ SII and $ SDS data stream key
SI_QuotaCharged
0x38
8(2K)
The maximum file space that can be used quotas. If the value is 0 means no quota restrictions
SI_USN
0x40
8(2K)
File was last updated record number, the value is directly indexed $ UsnJrnl file, if the value of 0 indicates that the update log is prohibited

 
Domain name: www.mrtlab.com | | Telephone: +86-27-82621261 | Terms of use
MRT data recovery website,provides professional HDD firmware repair and data recovery technical resources!
Copyright 2003-2019 Powered By MrtLab