File Name property data structure for the MFT

In the NTFS file system, the type value of the file Name property is 0x30. From this property name you can know that the file name property is used to store file names, in fact, this property can also store the size and time of the file and other information. The MFT index number of the parent directory is also recorded in the file Name property, and the original directory tree structure can be built based on the MFT index number.

In the NTFS file system, the file name attribute is expressed in Unicode encoding, which is slightly different from the previously learned FAT32 file system.

Here is the data structure table for the file name property body

byte offset	Describe
00-07	The file parameter number of the parent directory
08-0f	File Settling Time
10-17	Last Modified Time
18-1f	MFT Change Time
20-27	Last Access time
28-2f	file Allocation space size
30-37	File Actual Size
38-3b	Sign
40	The length of the file name
41	Naming methods
42	Filename

POSIX is the largest file naming method, which supports filenames with a maximum length of 255 bytes, which is sensitive to case sensitivity.

The WIN32 name is smaller than the POSIX named range, with only uppercase letters.

DOS naming is a subset of Win32 named, using only uppercase letters, filenames cannot exceed 8 characters, and the extension can only be 3

File Name property data structure for the MFT