Small Data File May Be Stored in NTFS Header Area (92517)


The information in this article applies to:

  • Microsoft Windows NT Server 3.1
  • Microsoft Windows NT Workstation 3.1
This article was previously published under Q92517

SUMMARY

The NT File System (NTFS) file header contains general file information and a list of attribute pairs. An attribute pair is an attribute header and either the attribute information or a pointer to the attribute information. Some examples of attributes are a data stream, an alternate data stream, security, and extended attributes.

MORE INFORMATION

An NTFS header resembles the following:

file info | attribute pair | attribute pair | attribute pair...

If an individual attribute's data is too large, a pointer to the attribute's data is stored in the header rather than the data itself. If there are too many of these attribute pairs, then none of the attribute's data is stored in the header. In that case, pointers will be used to point to the attribute's data.

If the file is small enough and there is enough room in the NTFS header, the file can be placed directly in the NTFS header because the file data is regarded as an attribute. In a best-case scenario, if file data is the only attribute, then about 1 kilobyte (K) of file data can be fit into the header as attribute information.
Modification Type:MajorLast Reviewed:11/3/2003
Keywords:kbother KB92517
©2003 Microsoft Corporation. All rights reserved.