NTFS file system-MFT Property Body

In the previous article, we already know that the MFT attribute body is divided into two kinds, one is the permanent attribute header and the other is the structure of the two kinds of non-resident attribute header. So what is the data structure of the MFT attribute body, in fact, the MFT attribute body is different according to the type of the attribute header and its data structure.

The property body of the resident property is small and can be stored directly in the MFT entry. The properties of the non-resident property are large, and the MFT entries cannot be stored, so there is a need for additional space storage, which also leads to the difference in the property data structure of the resident and non-resident properties.

650) this.width=650; "src=" Http://s2.51cto.com/wyfs02/M02/83/E9/wKioL1d_ZXTDzg9NAAkwIhgk9gg304.jpg "title=" Resident properties Demo. jpg "alt=" wkiol1d_zxtdzg9naakwihgk9gg304.jpg "/>

is a file named 123.txt document, the content is 123123123, you can see that when the volume of data is small, the NTFS file system will directly store the data into the MFT entry.

-------------------------The following are non-resident properties----------------------------------------------

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M01/83/EA/wKiom1d_ZkPiZtXyAAju9chFtoM471.jpg "title=" Non-resident property. jpg "alt=" wkiom1d_zkpiztxyaaju9chftom471.jpg "/>

is a very resident MFT file named $mft, the very resident attribute is not the real content of the file, but the starting cluster number of the file content and the information containing how many clusters. This information we call him stream information. Data structure of cluster flow information Let's put it in the next lesson.

NTFS file system-MFT Property Body