Home | Files | Attributes | Concepts | Glossary

# Home - Table

Previous Next

## Overview

The tables in this documentation aren't completely consistant. Below is a key to the tables showing how various fields are represented.

## Footnotes

Any table fields that have footnote marks, e.g. (a), (e), will have a fuller description immediately below the table.

## Size Fields

In NTFS not all fields are of a fixed size. Some depend on the value of another field, some depend on the contents of the field.

All the numbers in size fields are in decimal format. e.g. 12 (twelve), 42 (forty-two).

Key | Name | Description
--- | --- | ---
12 | Fixed | This field is twelve bytes long. Its size is constant.
P8 | Padding | P8 means pad the field to an 8 byte boundary. The size of this field could be 0 - 7 bytes. P4 means 4 byte alignment, etc (a)
V | Variable | The length of this field depends on its contents. An example is a SID. To know its length, you must decode the structure.
S | X-Ref | A cross-reference shows that the size is defined elsewhere in the table. The size can be represented by any letter, except P or V.

(a) Any padding of a fixed size will be displayed as a fixed size.

## Indexes

Where a table represents an index, the key and data will be shown as below:

Offset | Size | Description
--- | --- | ---
0x00 | 2 | Offset to data
0x02 | 2 | Size of data
0x04 | 4 | Key | SID
0x08 | 4 | Data | Owner Id
0x0C | 4 | Data | Hash

## OS - Operating System

Note that the fields are not all used in exactly the same way. NT indicates old fields whereas 2K and XP indicate new fields.

OS | NTFS | Description
--- | --- | ---
blank | all | Used by all versions of Windows
NT | 1.2 | Only used in Windows NT
2K | 3.0 | Windows 2000 and later
XP | 3.1 | New to Windows XP

        repeating groups?
        link padding8, padding and other table features to help/tables
        consistant use of padding/alignment fields

Copyright (C) Validate HTML Validate CSS