NTFS multiple similar attributes

Question

NTFS files may have multiple file name attributes (corresponding to hard links), that have the same name (are unnamed) and type ($FILE_NAME).

Are there any other cases where attributes of the same type and name appear multiple times in the same file record?

score 0 · Answer 1 · edited May 23 '17 at 12:21

0

NTFS Files (and directories) can have multiple $DATA attributes. These are called Alternate Data Streams (ADS). See link. See a good pdf document

edited May 23 '17 at 12:21

Community

1
1

answered Apr 25 '12 at 05:09

mox

6,084
2
23
35

Thank you, I know it. I mean multiple attributes with same type and name – Isso Apr 25 '12 at 05:34
You're welcome. In the case of ADS, multiple same $DATA attributes type appear multiple times. – mox Apr 25 '12 at 06:00
I meant both type and name to be the same. For ADS only type is the same. Looks like only $FILE_NAME can have this behaviour – Isso May 07 '12 at 18:38

score 0 · Accepted Answer · answered May 07 '12 at 18:54

Looks like only $FILE_NAME attribute can present in a file record multiple times with the same type and name. This is implicitly indicated by looking at $AttrDef file content, where only $FILE_NAME has bit 2 (Indexed) set. The rest of the attribute types don't have this bit set.

NTFS multiple similar attributes

2 Answers2