Glossary

Attribute - $EA (0xE0)

Previous Next

Overview

Used to implement the HPFS extended attribute under NTFS. This file attribute may be non-resident because its stream is likely to grow.

As defined in $AttrDef, this attribute has a no minimum size but a maximum of 65536 bytes.

Layout of the Attribute

The Extended Attribute is a collection of name, value pairs.

Offset Size Description
~ ~ Standard Attribute Header
0x00 4 Offset to next Extended Attribute
0x04 1 Flags
0x05 1 Name Length (N)
0x06 2 Value Length (V)
0x08 N Name
N+0x08 V Value

Conversely, the Offset to next EA is the size of this EA.

Flags

Value Description
0x80 Need EA

Notes

Other Information

What is the role and the layout of the stream of this file attribute? It could be valuable to have a look at HPFS documentation.

Questions

Is it true that the EA name is not unicode?


Copyright ©