Attribute - $INDEX_ROOT (0x90)

Overview

This is the root node of the B+ tree that implements an index (e.g. a directory). This file attribute is always resident.

    Always resident.
    

Layout of the Attribute

    link up below
    

$INDEX_ROOT

Standard Attribute Header

Index Root

Index Header

Index Entry

Index Entry

...

Index Root

Index Header

Notes

Size

As defined in $AttrDef, this attribute has a no minimum or maximum size.

Flags

    silly to have a flag of 0x00, remove
    

The large index flag indicates whether the file attributes index allocation and bitmap are present (when the index is small enough to be stored completely in the root node, these two file attributes are missing).

Sequence of index entries

This is a sequence of index entries that has a variable length. The sequence is terminated with a special index entry whose last entry flag is set.

    This is the header for indexes, describing the INDEX_ENTRY records, which
    follow the INDEX_HEADER. Together the index header and the index entries
    make up a complete index.

    This is followed by a sequence of index entries (INDEX_ENTRY structures)
    as described by the index header.

    When a directory is small enough to fit inside the index root then this
    is the only attribute describing the directory. When the directory is too
    large to fit in the index root, on the other hand, two aditional attributes
    are present: an index allocation attribute, containing sub-nodes of the B+
    directory tree (see below), and a bitmap attribute, describing which virtual
    cluster numbers (vcns) in the index allocation attribute are in use by an
    index block.

    NOTE: The root directory (FILE_$root) contains an entry for itself.

    struct {
            ATTR_TYPES type;
            Type of the indexed attribute. Is $FILENAME for directories, zero
            for view indexes. No other values allowed.
            COLLATION_RULES collation_rule;        Collation rule used to sort the
            index entries. If type is $FILENAME, this must be COLLATION_FILENAME.

            __u32 bytes_per_index_block;
            Byte size of each index block (in the index allocation attribute).

            __u8 clusters_per_index_block;
            Cluster size of each index block (in the index allocation attribute), when
            an index block is >= than a cluster, otherwise this will be the log of
            the size (like how the encoding of the mft record size and the index
            record size found in the boot sector work). Has to be a power of 2.
    }  INDEX_ROOT;
    

List of Common Indexes

    which elements are shared between indexes?
    not relevant for index root