The MFT consists of a single attribute body, each of which has a corresponding property name. Properties such as the 0x10 type represent standard properties, and this property records the basic information of the file.
List of MFT properties for the NTFS file system
MFT Attribute Type value (16 binary) |
MFT Property Name |
Describe |
10 |
$STANDARD _iformation |
A standard property that contains properties for the basic properties of a file, read-only creation time, last access time, and so on. |
20 |
$ATTRIBUTE _list |
Property List |
30 |
$FILE _name |
File name attribute (Unicode encoding) |
40 |
$OBJECT _id |
Object ID property, 16-byte unique flag for a file or directory |
50 |
$SECURITY _descriptor |
Security descriptor properties, file access control security properties |
60 |
$VOLUME _name |
Volume Name Properties |
70 |
$VOLUME _information |
Volume Information properties |
80 |
$DATA |
Data properties of the file |
90 |
$INDEX _root |
Index Root Property |
A0 |
$INDEX _allocation |
is an extended version of the 90 property (90 properties can only be recorded in the MFT file list, the A0 property records the file list to the data area to record more files) |
B0 |
$BITMAP |
Bitmap properties |
C0 |
$REPARSE _point |
Reparse Point Properties |
D0 |
$EA _information |
Extended attribute Information |
E0 |
$EA |
Extended Properties |
100 |
$LOGGED _utility_stream |
EFS Encryption Properties |
Red flag: Indicates very important must remember
Green mark: It's better to remember that it's more important
No sign of the understanding can be
List of properties for the NTFS file system MFT