Byte Byte
Offset Size Value Description
------ ---- ----- --------------------------------
0x00 4 Attribute Type (e.g. 0x20, 0x80)
0x04 4 Length (including this header)
0x08 1 0x01 Non-resident flag
0x09 1 0x00 Name length
0x0A 2 0x00 Offset to the Name
0x0C 2 Flags
0x0E 2 Attribute Id (a)
0x10 8 Starting VCN
0x18 8 Last VCN
0x20 2 0x40 Offset to the Data Runs
0x22 2 Compression Unit Size (b)
0x24 4 0x00 Padding
0x28 8 Allocated size of the attribute (c)
0x30 8 Real size of the attribute
0x38 8 Initialized data size of the stream (d)
0x40 ... Data Runs
(a) Each attribute has a unique identifier
(b) Compression unit size = 2x clusters. 0 implies uncompressed
(c) This is the attribute size rounded up to the cluster size
(d) Always equal to the allocated size?