In the NTFS file system, the type value of the file Name property is 0x30. From this property name you can know that the file name property is used to store file names, in fact, this property can also store the size and time of the file and other information. The MFT index number of the parent directory is also recorded in the file Name property, and the original directory tree structure can be built based on the MFT index number.
In the NTFS file system, the file name attribute is expressed in Unicode encoding, which is slightly different from the previously learned FAT32 file system.
Here is the data structure table for the file name property body
byte offset |
Describe |
00-07 |
The file parameter number of the parent directory |
08-0f |
File Settling Time |
10-17 |
Last Modified Time |
18-1f |
MFT Change Time
|
20-27 |
Last Access time |
28-2f |
file Allocation space size |
30-37 |
File Actual Size |
38-3b |
Sign |
40 |
The length of the file name |
41 |
Naming methods |
42 |
Filename |
POSIX is the largest file naming method, which supports filenames with a maximum length of 255 bytes, which is sensitive to case sensitivity.
The WIN32 name is smaller than the POSIX named range, with only uppercase letters.
DOS naming is a subset of Win32 named, using only uppercase letters, filenames cannot exceed 8 characters, and the extension can only be 3
File Name property data structure for the MFT