|
From: Szakacsits S. <sz...@si...> - 2003-07-20 17:25:10
|
On Sat, 19 Jul 2003, Jeff Meininger wrote: > The $ATTRIBUTE_LIST attribute record structure is described here: > http://linux-ntfs.sourceforge.net/ntfs/attributes/attribute_list.html > > The table lists the "Base File Reference of the attribute" as an 8 byte > field at offset 0x10. This is incorrect; on my Windows XP formatted > volume, I find records that look like the following examples: > > 09 00 00 00 00 00 09 00 > f8 3c 00 00 00 00 4a 00 > 20 05 00 00 00 00 83 04 > > This leads me to believe that the file number is described by 4 bytes, > followed by two 2 byte values for who-knows-what. It's correct. From the 8 bytes, 6 bytes are the MFT reference and 2 bytes the MFT sequence number. But I agree, it's better documented in the sources than in the NTFS documentation. Feel free to submit documentation update patches to Rich (nt...@fl...). He doesn't have time to update it, just like any of us ... > I posted another documentation "bug" a while back, but nobody has > responded and the docs are still incorrect. That bug was as follows: > > The $Boot file (boot sector) structure is described here: > http://linux-ntfs.sourceforge.net/ntfs/files/boot.html > > The table lists a 4-byte value at offset 0x0024 as "Always 80 00 80 00". > This seems to be the case for partitions on hard disks that I have > access to. If I format a USB thumb drive as NTFS in Windows XP, > however, this field shows up as "80 00 00 00". Perhaps the difference > is due to the thumb drive being "removable media", or perhaps it has to > do with the fact that the drive itself is formatted as NTFS rather than > a partition on the drive. Both Rich and me answered, not only to the list but to your private address as well (please see the list archive). Hope you get this one ... Thanks & cheers, Szaka |
