NTFS Attributes
•
Index Entry
•
...
10.2.1. Index Root Table 2.24. Layout of the $INDEX_ROOT (0x90) attribute: an Index Root Offset
Size
Description
~
~
Standard Attribute Header
0x00
4
Attribute Type
0x04
4
Collation Rule
0x08
4
Size of Index Allocation Entry (bytes)
0x0C
1
Clusters per Index Record
0x0D
3
Padding (Align to 8 bytes)
10.2.2. Index Header Table 2.25. Layout of the $INDEX_ROOT (0x90) attribute: an Index Header Offset
Size
Description
0x00
4
Offset to first Index Entry
0x04
4
Total size of the Index Entries
0x08
4
Allocated size of the Index Entries
0x0C
1
Flags
0x0D
3
Padding (align to 8 bytes)
10.2.3. Flags Table 2.26. Index flags Flag
Description
0x00
Small Index (fits in Index Root)
0x01
Large index (Index Allocation needed)
silly to have a flag of 0x00, remove
The large index flag indicates whether the file attributes index allocation and bitmap are present (when the index is small enough to be stored completely in the root node, these two file attributes are missing).
10.3. Notes 26