Attributes

Attributeの構造

Attributeはヘッダーとコンテンツに分けられる

ヘッダー

ヘッダーはResidentとNon-Residentの2種類がある。

Resident

Resident Attribute Header
0 1 2 3 4 5 6 7 8 9 A B C D E F
00 Type ID Attribute Length Form code name len Name offset flags Attrib ID
10 Content length Content offset unused

Typde ID
ID Attribute Type
0x0010 Standard Information
0x0020 Attribute List
0x0030 File Name
0x0040 Object ID
0x0050 Security Descriptor
0x0060 Volume Name
0x0070 Volume Information
0x0080 Data
0x0090 Index Root
0x00A0 Index Allocation
0x00B0 Bitmap
0x00C0 Reparse Point
0x0100 Logged Tool Stream

Attribute Length - このAttributeのサイズ
Form code - 0
name len
Name offset
flags
Attrib ID
Content length
Content offset

Non Resident

Non Resident Attribute Header
0 1 2 3 4 5 6 7 8 9 A B C D E F
00 Type ID Attribute Length Form code name len Name offset flags Attrib ID
10 Start virtual cluster number Ending virtual cluster number
20 Runlist offset Compression unit size 0x00000000 Size of attribute content
30 size on disk of attribute content Initialized size of attribute content
40 Data runlists

Typde ID - Residentと同じ
Attribute Length - このAttributeのサイズ
Form code - 1
name len
Name offset
flags
Attrib ID
Start virtual cluster number
Ending virtual cluster number
Runlist offset - Run list へのoffset
Compression unit size
Size of attribute content
size on disk of attribute content
Initialized size of attribute content

コンテンツ

コンテンツの種類

ID コンテンツ
0x0010 Standard Information
0x0020 Attribute List
0x0030 File Name
0x0040 Object ID
0x0050 Security Descriptor
0x0060 Volume Name
0x0070 Volume Information
0x0080 Data
0x0090 Index Root
0x00A0 Index Allocation
0x00B0 Bitmap
0x00C0 Reparse Point
0x0100 Logged Tool Stream

例

residentヘッダーのStandard Information Attribute

non residentヘッダーのData Attribute