NTFS Documentation: $AttrDef

Definition

This is a system file containing information about all the file attributes useable in a volume.

Layout

Its layout is a sequence of records. Each record defines one file attribute, and its layout is:

Offset to the beginning of the record Length Description

0 80 Label in Unicode

80 8 Type

88 8 Flags

90 8 Minimum allowed size

98 8 Maximum allowed size

Offset to the beginning of the record	Length	Description
0	80	Label in Unicode
80	8	Type
88	8	Flags
90	8	Minimum allowed size
98	8	Maximum allowed size

Label in Unicode: Probably terminated with a null Unicode character: 00 00.

Interest

One can add user-defined file attributes to this file.

This file might let older versions of the NTFS driver safely use more recent volumes.

Questions

The exact meaning of the flags is still not clear. It seems that:

Bit Signification

00000001 May be indexed

00000040 Need to be regenerated during the regeneration phase

00000080 May be non-resident

Bit	Signification
00000001	May be indexed
00000040	Need to be regenerated during the regeneration phase
00000080	May be non-resident

Note: all other flags are clear for the available file attributes. But as far as TechNet is concerned, we should also find indexing rules, display rules, and security information.

Regis Duchesne at VIA, ECP, France

Last modified: Mon Feb 15 09:02:08 PST 1999