| Glossary |
This is a glossary of all terms.
Some entries refer to other entries, e.g. See also
.
Some entries have an entire page of their own, e.g. More...
If your browser supports access keys, then you can jump around this
document by using, for example, Alt-M for the M section.
Access Allowed,
Access Deniedor
System Audit. This object has flags to determine how the permissions should be inherited.
FIXME
"BAAD" == corrupt record
"CHKD" == chkdsk ???
"FILE" == mft entry
"HOLE" == ??? (NTFS 3.0+?)
"INDX" == index buffer
RSTR & ???
Dynamic disk SDS, win2k
Archive,
System,
Hiddenand
Read Only. In addition, NTFS supports
Compressedand
Encrypted.
FILE. Each record has a standard header and a list of attributes. If the attributes don't fit into a single record, then more records will be used and a $ATTRIBUTE_LIST attribute will be needed.
FRS = MFT File Record
The valid format for a GUID is {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}
Globally Unique Identifier (GUID)
GUID structures store globally unique identifiers (GUID). A GUID is a
128-bit value consisting of one group of eight hexadecimal digits, followed
by three groups of four hexadecimal digits each, followed by one group of
twelve hexadecimal digits. GUIDs are Microsoft's implementation of the
distributed computing environment (DCE) universally unique identifier (UUID).
Example of a GUID:
1F010768-5A73-BC91-0010A52216A7
order stored on disk?
01020304-0506-0708-090A0B0C0D0E0F010
0x00 04030201
0x04 0605
0x06 0807
0x08 090A0B0C0D0E0F010
meta-data
Data about data. In data processing, meta-data is definitional data
that provides information about or documentation of other data managed
within an application or environment.
For example, meta data would document data about data elements or
attributes, (name, size, data type, etc) and data about records or
data structures (length, fields, columns, etc) and data about data
(where it is located, how it is associated, ownership, etc.). Meta
data may include descriptive information about the context, quality
and condition, or characteristics of the data.
multiple sectors, fixup, safety checks
partition table...
SFS Win2K dynamic disk
Read Onlyand
Hidden. The other is based on ACEs and allows granting specific permissions to specific users.
obsolete
Read Onlyand
Hiddenand an ACL model which grants specific permissions to specific users.
sizeof a file is the size of its unnamed data attribute.
standardise 4 time fields name & description concept page?
refer to 4 times as:
C creation
A alter (modification)
M mft (mft changed)
R read (last access)
FIXME:
NOTE: There is conflicting information about the meaning of each of the time
fields but the meaning as defined below has been verified to be
correct by practical experimentation on Windows NT4 SP6a and is hence
assumed to be the one and only correct interpretation.
creation_time
Time file was created. Updated when a filename is changed(?).
last_data_change_time
Time the data attribute was last modified.
last_mft_change_time
Time this mft record was last modified.
last_access_time
Approximate time when the file was last accessed (obviously this is not
updated on read-only volumes). In Windows this is only updated when
accessed if some time delta has passed since the last update.
N.B. There is conflicting information about the meaning of each of the time
fields but the meaning as defined below has been verified to be
correct by practical experimentation on Windows NT4 SP6a and is hence
assumed to be the one and only correct interpretation.
| Abbr. | Name | Exactly | Approx. |
|---|---|---|---|
| KB | Kilobyte | 210 | 103 |
| MB | Megabyte | 220 | 106 |
| GB | Gigabyte | 230 | 109 |
| TB | Terabyte | 240 | 1012 |
see also Binary, Decimal, HexadecimalN.B. Technically, the correct abbreviation for 1024 bytes is KiB, which stands for kilobinary bytes.
The Update Sequence Array (usa) is an array of the __u16 values which belong
to the end of each sector protected by the update sequence record in which
this array is contained. Note that the first entry is the Update Sequence
Number (usn), a cyclic counter of how many times the protected record has
been written to disk. The values 0 and -1 (ie. 0xffff) are not used. All
last __u16's of each sector have to be equal to the usn (during reading) or
are set to it (during writing). If they are not, an incomplete multi sector
transfer has occured when the data was written.
The maximum size for the update sequence array is fixed to:
maximum size = usa_ofs + (usa_count * 2) = 510 bytes
The 510 bytes comes from the fact that the last __u16 in the array has to
(obviously) finish before the last __u16 of the first 512-byte sector.
This formula can be used as a consistency check in that usa_ofs +
(usa_count * 2) has to be less than or equal to 510.
used for logging