Home | Files | Attributes | Concepts | Glossary

# Attribute - $ATTRIBUTE_LIST (0x20)

Previous Next

## Overview

When there are lots of attributes and space in the MFT record is short, all those attributes that can be made non-resident are moved out of the MFT. If there is still not enough room, then an $ATTRIBUTE_LIST attribute is needed. The remaining attributes are placed in a new MFT record and the $ATTRIBUTE_LIST describes where to find them. It is very unusual to see this attribute.

## Layout of the Attribute

After the standard header, this attribute contains a list of variable length records, describing the type and location (in the MFT) of all the other attributes belonging to this file. Each record is aligned on an 8-byte boundary.

The list is sorted by:

1. Attribute type
2. Attribute name (if present)
3. Sequence number

N.B. It does not list itself.

Offset | Size | Description
--- | --- | ---
~ | ~ | Standard Attribute Header
0x00 | 4 | Type
0x04 | 2 | Record length
0x06 | 1 | Name length (N)
0x07 | 1 | Offset to Name (a)
0x08 | 8 | Starting VCN (b)
0x10 | 8 | Base File Reference of the attribute
0x18 | 2 | Attribute Id (c)
0x1A | 2N | Name in Unicode (if N > 0)

(a) If the name doesn't exist, does this point at the attribute or zero?
(b) Starting VCN, or zero if the attribute is resident
(c) Each attribute has a unique identifier

    (a) it always points to where the name would be (0x1A)

    0x04 record allocation (8 byte alignment)

    (c) always seems to be zero, check

    (c) no it's only shown the first time for a given attribute type

    not sure about sorting by sequence number.  VCN definitely

## Notes

### $AttrDef

It can be either resident or non-resident. This attribute has a no minimum or maximum size.

### Other Information

The offset at 0x07 is just one byte long, unusual for an attribute.

If this attribute is non-resident, then the data runs must fit into one MFT record.

The $ATTRIBUTE_LIST may be needed if the file:

- has a large number of hard links (lots of file name attributes present).
- becomes very fragmented, so the data runs overflow the MFT record.
- has a complex security descriptor (not applicable to NTFS v3.0+
- has many named streams, e.g. data streams.

### To Do

        8 VCN lowest_vcn;
        Lowest virtual cluster number of this portion of the attribute value. This is usually 0. It
        is non-zero for the case where one attribute does not fit into one mft record and thus
        several mft records are allocated to hold this attribute. In the latter case, each mft
        record holds one extent of the attribute and there is one attribute list entry for each
        extent. NOTE: This is DEFINITELY a signed value! The windows driver uses cmp, followed
        by jg when comparing this, thus it treats it as signed.

        24 __u16 instance;
        If lowest_vcn = 0, the instance of the attribute being referenced; otherwise 0.

        The attribute list is used in case where a file need extension FILE records in the
        MFT to be fully described, in order to find any file attribute of this file.
        This file attribute may be non-resident because its stream is likely to grow.

        The extents of one non-resident attribute (if present) immediately follow
        after the initial extent. They are ordered by lowest_vcn and have their instance set to zero.

Copyright (C) Validate HTML Validate CSS