MFT attributes (from $AttrDef)

• • • 10 = $STANDARD_INFORMATION
    • 20 = $ATTRIBUTE_LIST (group of attributes)
    • 30 = $FILE_NAME
    • 40 = $OBJECT_ID
    • 50 = $SECURITY_DESCRIPTOR
    • 60 = $VOLUME_NAME
    • 70 = $VOLUME_INFORMATION
    • 80 = $DATA (default or named data stream)
    • 90 = $INDEX_ROOT (B-tree root, directories)
    • A0 = $INDEX_LOCATION
    • B0 = $BITMAP
    • C0 = $REPARSE_POINT
    • D0 = EA_INFORMATION
    • E0 = EA (actual OS/2 extended attribute data)
    • 100 = LOGGED_UTILITY_STREAM