Attribute List

The layout of an attribute is

    offset(length)          Description
    0(4)                    Type
    4(4)                    Length
    8(1)                    0=resident, 1=data stored in runs
    9(1)                    name length
    A(1)                    offset to name or resident data
    C(1)                    1=compressed
    E(2)                    Attribute ID
    Resident attributes:
    10(2?)                  data length
    14(2?)                  offset to data
    Nonresident attributes:
    10(8)                   starting VCN of this segment
    18(8)                   last VCN of this segment
    20(2)                   offset to data
    22(2?)                  Number of compression engine ? '4' for compressed files
    28(8)                   size of the attribute
    30(8)                   allocated disk space
    38(8)                   length of initialized data
    40(8)                   compressed size
    All:
    data start              Name (if present)
    data start + namelen    start of data or data runs

The following attribute types are known. The list of attributes of a volume is stored in the $Attribute file.

- Standard information (10)
- Attribute list (20)
- File name (30)
- Volume version (40)
- Security descriptor (50)
- Volume name (60)
- Volume information (70)
- Data (80)
- Index root (90)
- Index Allocation (A0)
- Bitmap (B0)
- Symlink (C0)
- HPFS extended attributes information (D0)
- HPFS extended attributes (E0)

The data structure of the attributes 20,40,50,60,70,B0,C0,D0, and E0 is unknown.

For nonresident attributes, the data is stored in runs.