| Glossary |
Used to implement the HPFS extended attribute under NTFS. This file attribute may be non-resident because its stream is likely to grow.
As defined in $AttrDef, this attribute has a no minimum size but a maximum of 65536 bytes.
The Extended Attribute is a collection of name, value pairs.
| Offset | Size | Description |
|---|---|---|
| ~ | ~ | Standard Attribute Header |
| 0x00 | 4 | Offset to next Extended Attribute |
| 0x04 | 1 | Flags |
| 0x05 | 1 | Name Length (N) |
| 0x06 | 2 | Value Length (V) |
| 0x08 | N | Name |
| N+0x08 | V | Value |
Conversely, the Offset to next EA
is the size of this EA.
| Value | Description |
|---|---|
| 0x80 | Need EA |
What is the role and the layout of the stream of this file attribute? It could be valuable to have a look at HPFS documentation.
Is it true that the EA name is not unicode?