26. Attribute Headers

• Any standard NTFS attribute has a header:

  • length, because attributes have variable lengths

  • optional name

  • flags

  • how to find it on disk (if the attribute resides elsewhere on disk -- not inside the MFT record)

  • etc.