Properties header for NTFS file system-MFT

As mentioned earlier, the MFT is composed of a single attribute, so what is the specific structure of each attribute? There are many types of MFT properties, but they all have a common feature, which is that each property has a property header and an attribute body. Attribute headers are also categorized as resident and non-resident properties. The biggest difference between resident and non-resident data is that the resident attribute is only recorded inside the MFT, and very resident data is recorded in other data areas due to the MFT record (one MFT entry is only 1024). Whether it is a resident property or a very resident property, the first 16 bytes of its property header are the same.

MFT Attribute structure diagram

650) this.width=650; "Src=" Http://s3.51cto.com/wyfs02/M01/83/D6/wKiom1d92ujwQtkaAAZ7bE8h8jc381.jpg-wh_500x0-wm_3 -wmp_4-s_565655920.jpg "title=" 1.JPG "alt=" Wkiom1d92ujwqtkaaaz7be8h8jc381.jpg-wh_50 "/>

It can be seen that the MFT head is small, only a few lines of code, and the rest are the properties of the MFT. The 10 and 30 properties are resident properties, and the 80 property is a non-resident property because the 80 attribute is a property that records the contents of a file, which is generally not a few bytes. Let's look at the specific structure of the property header of the very resident attribute

Offset byte (16 binary)	Describe
00-03	Property type
04-07	Property length
08	Resident attribute flag 00: resident; 01 means very resident.
09	Property name Length (0 = no attribute name)
0a-0b	Property name offset (relative to the property header)
0c-0d	Sign
0e-0f	Property ID Flag
10-13	Attribute Body size
14-15	The size of the property header
16	Index
17	Keep

Data structures for non-resident property headers

Offset byte (16 binary)	Describe
00-03	Property type
04-07	Property length
08	Resident attribute flag 00: resident; 01 means very resident.
09	Property name Length (0 = no attribute name)
0a-0b	Property name offset (relative to the property header)
0c-0d	Sign
0e-0f	Property ID Flag
10-17	The starting virtual cluster number of the cluster stream (always starting from 0)
18-1f	End of cluster stream virtual cluster number
20-21	The cluster flow list is offset from the beginning of this property header
22-23	Compression unit size
24-27	Keep
28-2f	Space-size bytes allocated for attribute content
30-37	The size of the property content actually occupies the number of bytes
38-3f	Property content Initial Size byte number

The last 3 parameters of the non-resident property header all represent the size of the property content, which can be written as large.

Property header for NTFS file system-MFT