Attribute List in MFT? How to add...

NTFSD
1

Hello!

I wonder if anybody can help me on this as it seems that either I am
blindfolded, either such things as I want do not exist…

From the MFT documentation that I have and studied, it seems that you can
add a number of arbitrary attributes in the MFT record, as each record is
actually a collection of attributes.
Somehow, for example, windows Explorer can display a list of all kinds of
file attributes, many of which are not “common” file attributes (like audio
sample rate, caller ID, etc).

My question is, how do you add them from a high-level API? Are there any
high-level functions that can add such attributes or is it something that
has to be done at the FSD level? Or is this done as Explorer merely opens
the files and read all kind of info data from them (this was my first idea).

Thanks in advance.
–Razvan.

2

The thing is that explorer actually reads “uncommon” file attributes (like
audio sample rate, caller ID, etc) from the file. I used
www.sysinternals.com FILEMON utility to monitor audio and video files, and
that’s what seems to happend. Actually, these are not attributes, they are
file properties (explorer doesn’t seem to make the difference).

Sorin

“Razvan Costea-B.” wrote in message
news:xxxxx@ntfsd…
>
> Hello!
>
> I wonder if anybody can help me on this as it seems that either I am
> blindfolded, either such things as I want do not exist…
>
> From the MFT documentation that I have and studied, it seems that you can
> add a number of arbitrary attributes in the MFT record, as each record is
> actually a collection of attributes.
> Somehow, for example, windows Explorer can display a list of all kinds of
> file attributes, many of which are not “common” file attributes (like
audio
> sample rate, caller ID, etc).
>
> My question is, how do you add them from a high-level API? Are there any
> high-level functions that can add such attributes or is it something that
> has to be done at the FSD level? Or is this done as Explorer merely opens
> the files and read all kind of info data from them (this was my first
idea).
>
> Thanks in advance.
> --Razvan.
>
>
>
>

3

Thank you Sorin!

The question though still stands… How do you write additional attributes
in the MFT and who can read them??? Since the MFT attribute header
structure contains pointers to the attribute name, for instance, in my mind
this means that there should be some application out there that really
reads that information; but how is that done?

Or am I missing something here - or walking on a totally wrong path?

–Razvan

At 15:55 26-11-02, you wrote:

The thing is that explorer actually reads “uncommon” file attributes (like
audio sample rate, caller ID, etc) from the file. I used
www.sysinternals.com FILEMON utility to monitor audio and video files, and
that’s what seems to happend. Actually, these are not attributes, they are
file properties (explorer doesn’t seem to make the difference).

4

To create a new named stream in an NTFS file, simply append the
stream name to the end of the filename during your CreateFile call, like
this:
CreateFile(“C:\test.txt:fred”, GENERIC_WRITE, 0, 0L, OPEN_EXISTING, 0, 0L);
Enumeration is tricky, IIRC. I no longer have access to the IFS
kit, but I think I remember that the enumeration of streams required a
specific file information type for NtQueryInformationFile call (someone help
me here…)
You may wish to look at the Win32 backup api (BackupRead, etc) as
well.
There are also extended attributes that can be accessed through the
native api (forgot there names, take a look at the exports in ntdll.dll.
Look for *EaFile*).
Then again, EXPLORER could be using some sort of higher level
contruct, such as COM structured storage to embed these values.

-----Original Message-----
From: Razvan Costea-B. [mailto:xxxxx@laitek.com]
Sent: Tuesday, November 26, 2002 9:13 AM
To: File Systems Developers
Subject: [ntfsd] Re: Attribute List in MFT? How to add…

Thank you Sorin!

The question though still stands… How do you write additional attributes
in the MFT and who can read them??? Since the MFT attribute header
structure contains pointers to the attribute name, for instance, in my mind
this means that there should be some application out there that really
reads that information; but how is that done?

Or am I missing something here - or walking on a totally wrong path?

–Razvan

At 15:55 26-11-02, you wrote:

The thing is that explorer actually reads “uncommon” file attributes (like
audio sample rate, caller ID, etc) from the file. I used
www.sysinternals.com FILEMON utility to monitor audio and video files, and
that’s what seems to happend. Actually, these are not attributes, they are
file properties (explorer doesn’t seem to make the difference).

You are currently subscribed to ntfsd as: xxxxx@Veritas.com
To unsubscribe send a blank email to %%email.unsub%%

5

> Somehow, for example, windows Explorer can display a list of all
kinds of

file attributes, many of which are not “common” file attributes
(like audio
sample rate, caller ID, etc).

Explorer usually displays not NTFS attributes, but some data extracted
from the file’s header by a particular shell extension.

My question is, how do you add them from a high-level API?

Open a file names like MyFile.Dat:MyAttribute and write there.

has to be done at the FSD level? Or is this done as Explorer merely
opens
the files and read all kind of info data from them (this was my
first idea).

Yes, though it can also use the attributes.

Max