File: standard.html

package info (click to toggle)
ntfs 971218-4
  • links: PTS
  • area: main
  • in suites: hamm, slink
  • size: 692 kB
  • ctags: 670
  • sloc: ansic: 7,774; sh: 1,509; makefile: 232
file content (23 lines) | stat: -rw-r--r-- 894 bytes parent folder | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
<title>Standard information attribute</title>
The layout of the data in the standard information is as follows. Note 
that all offsets are relativ to the beginning of the data, not to the
attribute
<pre>
Offset(length)    Description
0(8)              File creation time
8(8)              Last modification time
10(8)             Last modification time for MFT record
18(8)             Last access time
20(4)             MS-DOS file permissions:
                  800         file is compressed
				  020         archive bit
				  004         system bit
				  002         hidden bit
				  001         read-only bit
24(C)             unused, zero
</pre>
The time values are stored in universal coordinated time, which is based
on Jan 1, 1601, and in units of 100ns. It is not clear whether the value
should be considered signed :-).
<p><i>Where is the other information mentioned on p. 23?</i>