| Glossary |
Every Index Record has a standard header and a set of blocks containing an Index Key and Index Data.
The size of an Index Record is defined in $Boot and always seems to be 4KB.
| Offset | Size | Description |
|---|---|---|
| 0x00 | 4 | Magic number 'INDX' |
| 0x04 | 2 | Offset to the Update Sequence |
| 0x06 | 2 | Size in words of the Update Sequence Number & Array (S) |
| 0x08 | 8 | $LogFile sequence number |
| 0x10 | 8 | VCN of this INDX buffer in the Index Allocation |
| 0x18 | 4 | Offset to the Index Entries (a) |
| 0x1C | 4 | Size of Index Entries (a) |
| 0x20 | 4 | Allocated size of the Index Entries (a) |
| 0x24 | 1 | 1 if not leaf node (b) |
| 0x25 | 3 | Padding (always zero) |
| 0x28 | 2 | Update sequence |
| 0x2A | 2S-2 | Update sequence array |
(a) These values are relative to 0x18
(b) Has children
| Name | Index Of | Description |
|---|---|---|
| $I30 | Filenames | Used by Directories |
| $SDH | Security Descriptors | $Secure |
| $SII | Security Ids | $Secure |
| $O | Object Ids | $ObjId |
| $O | Owner Ids | $Quota |
| $Q | Quotas | $Quota |
| $R | Reparse Points | $Reparse |
There is no information contained in the Index Record describing what the index is storing (this is kept in the Index Root).