ATTR_FILE_NAME Struct Reference

#include <Driver.h>

Data Fields
UINT64	ParentDir
UINT64	CreationTime
UINT64	AlteredTime
UINT64	ChangedMftTime
UINT64	ReadTime
UINT64	AllocatedSize
UINT64	RealSize
UINT32	Flags
UINT32	Reparse
UINT8	FilenameLen
UINT8	Namespace

Detailed Description

Table 2.5. Layout of the $FILE_NAME (0x30) attribute

---

Offset | Size | Description

~ | ~ | Standard Attribute Header 0x00 | 8 | File reference to the base record of the parent directory. 0x08 | 8 | C Time - File Creation 0x10 | 8 | A Time - File Altered 0x18 | 8 | M Time - MFT Changed 0x20 | 8 | R Time - File Read 0x28 | 8 | Allocated size of the file (a multiple of the Cluster size) 0x30 | 8 | Real size of the file (size of the unnamed $Data Attribute) 0x38 | 4 | Flags, e.g. Directory, compressed, hidden 0x3c | 4 | Used by EAs and Reparse 0x40 | 1 | Filename length in characters (L) 0x41 | 1 | Filename namespace

0x42 | 2L | File name in Unicode (not null terminated)

Definition at line 504 of file Driver.h.

Field Documentation

AllocatedSize

UINT64 ATTR_FILE_NAME::AllocatedSize

Definition at line 510 of file Driver.h.

AlteredTime

UINT64 ATTR_FILE_NAME::AlteredTime

Definition at line 507 of file Driver.h.

ChangedMftTime

UINT64 ATTR_FILE_NAME::ChangedMftTime

Definition at line 508 of file Driver.h.

CreationTime

UINT64 ATTR_FILE_NAME::CreationTime

Definition at line 506 of file Driver.h.

FilenameLen

UINT8 ATTR_FILE_NAME::FilenameLen

Definition at line 514 of file Driver.h.

Flags

UINT32 ATTR_FILE_NAME::Flags

Definition at line 512 of file Driver.h.

Namespace

UINT8 ATTR_FILE_NAME::Namespace

Definition at line 515 of file Driver.h.

ParentDir

UINT64 ATTR_FILE_NAME::ParentDir

Definition at line 505 of file Driver.h.

ReadTime

UINT64 ATTR_FILE_NAME::ReadTime

Definition at line 509 of file Driver.h.

RealSize

UINT64 ATTR_FILE_NAME::RealSize

Definition at line 511 of file Driver.h.

Reparse

UINT32 ATTR_FILE_NAME::Reparse

Definition at line 513 of file Driver.h.

---

The documentation for this struct was generated from the following file:

• Platform/OpenNtfsDxe/Driver.h