| Glossary |
The Object Id was introduced in Windows 2000. Every MFT Record is assigned a unique GUID. Additionally, a record may have a Birth Volume Id, a Birth Object Id and a Domain Id, all of which are GUIDs.
As defined in $AttrDef, this attribute has a no minimum size but a maximum of 256 bytes.
| Offset | Size | Name | Description |
|---|---|---|---|
| ~ | ~ | Standard Attribute Header | |
| 0x00 | 16 | GUID Object Id | Unique Id assigned to file |
| 0x10 | 16 | GUID Birth Volume Id | Volume where file was created |
| 0x20 | 16 | GUID Birth Object Id | Original Object Id of file |
| 0x30 | 16 | GUID Domain Id | Domain in which object was created |
Birth Volume Id is the Object Id of the Volume on which the Object Id was allocated. It never changes.
Birth Object Id is the first Object Id that was ever assigned to this MFT Record. I.e. If the Object Id is changed for some reason, this field will reflect the original value of the Object Id.
Domain Id is currently unused but it is intended to be used in a network environment where the local machine is part of a Windows 2000 Domain. This may be used in a Windows 2000 Advanced Server managed domain.
This Attribute may be just 16 bytes long (the size of one GUID).
Even if the Birth Volume, Birth Object and Domain Ids are not used, they may be present, but one or more may be zero.
Need examples where all the fields are used.