Concept - Index Record

Overview

This is only applicable to a file index ($I30)

    indx help describe as "index = key + data"

    given an INDX record, it's difficult to work out what's
    being indexed (that info is in the index root)

Definition

This is a sub-node of the B+ tree that implements an index (e.g. a directory). It is stored in the stream of the index allocation attribute associated to the index it belongs to.

Layout

An INDX buffer is at least 2 KB large or the cluster size if larger (this seems to be a per-index parameter). It falls into 2 parts:

The header part

this ISN'T just the header...

Offset	Size	Description
~	~	Standard Index Header
0x00	8	MFT Reference of the file
0x08	2	Size of this index entry
0x0A	2	Offset to the filename
0x0C	2	Index Flags
0x0E	2	Padding (align to 8 bytes)
0x10	8	MFT File Reference of the parent
0x18	8	File creation time
0x20	8	Last modification time
0x28	8	Last modification time for FILE record
0x30	8	Last access time
0x38	8	Allocated size of file
0x40	8	Real size of file
0x48	8	File Flags
0x50	1	Length of filename (F)
0x51	1	Filename namespace
0x52	2F	Filename
2F+0x52	P	Padding (align to 8 bytes)
P+2F+0x52	8	VCN of index buffer with sub-nodes

    N.B. the filename is not null terminated
    surely the flags can't be 8 bytes long
    table for the flags
    VCN of ib only exists when flags&1
    last entry has a size of 0x10 (just large enough
    for the flags (and a mft ref of zero))

The sequence of index entries part

This is a sequence of index entries similar to the one found in the index root attribute.

The index entry has the following structure:

    Index entry flags (16-bit).

    INDEX_ENTRY_NODE = cpu_to_le16(1), This entry contains a sub-node,
                      i.e. a reference to an index
                      block in form of a virtual
                      cluster number (see below).
    INDEX_ENTRY_END  = cpu_to_le16(2), This signifies the last entry in
                      an index block. The index entry
                      does not represent a file but it
                      can point to a sub-node.

    This is an index entry. A sequence of such entries follows each INDEX_HEADER
    structure. Together they make up a complete index. The index follows either
    an index root attribute or an index allocation attribute.

    NOTE: Before NTFS 3.0 only filename attributes were indexed.

Most entries are not valid (and present) if the entry is the last one. This entry does not represent a file and is used only for subnodes. The pointer to the subnode buffer is only present if the entry has subnodes.