D) File System Data / Area
NTFS view every each of file and folder in the volume as the file attribute . This file attribute including file name, security information and also the data. Each of file attributes are identifies by an attribute type code and optional attribute name .
As mention earlier, each file or folder exist in NTFS volume recorded on Mft as file or folder records. What actually is this file and folder records? It is the file attribute for each file as well as the partition of that file record within the Mft. Unfortunately, not all of file attribute can fit within Mft. If the file attribute can fit within the Mft, it is called resident attributes. For instance, file attribute such as file name and time stamp always be resident attribute. On the other hand, if the file attributes does not fit the Mft, it is called non-resident attributes. Non-resident attributes stores a portion of the file attribute within Mft and the remaining are stores in other cluster outside the Mft. NTFS creates the attribute list table to describe the location of the attribute records. Figure 6 illustrated File Attributes Types.
Attribute Type | Description |
Standard Information | Information such as access mode, timestamp and link count |
Attribute List | Locations of all attribute records that not fit in MFT record |
File Name | Name of the file. |
Data | File data that contain file attributes. |
Object ID | Unique file identifier. |
Logged Tool Stream | Data stream that logged to NTFS log. |
Reparse Point | Used for mounted drives and mark special file for the particular file. |
Index Root | Used to implement folder and other indexes |
Index Allocation | Used to implement the B-tree structure for large folders and other large indexes |
Bitmap | Used to implement the B-tree structure for large folders and other large indexes |
Volume Information | Contains volume version |
Figure 6 File Attributes Types
RSS Feed (xml)
No comments:
Post a Comment