Attribute - $DATA (0x80)

Overview

This Attribute contains the file's data. A file's size is the size of its unnamed Data Stream.

As defined in $AttrDef, this attribute has a no minimum or maximum size.

Layout of the Attribute (Resident)

Offset	Size	Description
~	~	Standard Attribute Header
0x00		Any data

Layout of the Attribute (Non-Resident)

Notes

Common Data Stream Used By Windows

[Unnamed]
{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
^EDocumentSummaryInformation
^ESebiesnrMkudrfcoIaamtykdDa
^ESummaryInformation
$MountMgrDatabase
$Bad
$SDS
$J
$Max

Other Information

Usually, a directory has no Data Attribute, and the Data Attribute of a file has no name.

    must have (at least empty) unnamed data attr

NTFS has an advantage: as you can have several data attributes for a file, you can easily implement HFS whose files are made of two parts (also called forks in the HFS terminology): a resource part and a data part. For the data part, you use default unnamed data attribute, and for the resource part, you use a data attribute named e.g. 'resource'.