Glossary |
This file attribute is a sequence of bits, each of which represents the status of an entity.
As defined in $AttrDef, this attribute has a no minimum or maximum size.
This attribute is currently used in two places: indexes (e.g. directories), $MFT. N.B. The index entries and the FILE records also have flags in them to show if they are in use or not.
In an index, the bit field shows which index entries are in use. Each bit represents one VCN of the index allocation.
In the $MFT, the bit field shows which FILE records are in use.
Offset | Size | Description |
---|---|---|
~ | ~ | Standard Attribute Header |
0x00 | Bit field |