Byte Byte
Offset Size Value Description
------ ---- ----- --------------------------------
0x00 4 Attribute Type (e.g. 0x80, 0xA0)
0x04 4 Length (including this header)
0x08 1 0x01 Non-resident flag
0x09 1 N Name length
0x0A 2 0x40 Offset to the Name
0x0C 2 Flags
0x0E 2 Attribute Id (a)
0x10 8 Starting VCN
0x18 8 Last VCN
0x20 2 2N+0x40 Offset to the Data Runs (b)
0x22 2 Compression Unit Size (c)
0x24 4 0x00 Padding
0x28 8 Allocated size of the attribute (d)
0x30 8 Real size of the attribute
0x38 8 Initialized data size of the stream (e)
0x40 2N Unicode The Attribute's Name
2N+0x40 ... Data Runs (b)
(a) Each attribute has a unique identifier
(b) Rounded up to a multiple of 4 bytes
(c) Compression unit size = 2x clusters. 0 implies uncompressed
(d) This is the attribute size rounded up to the cluster size
(e) Always equal to the allocated size?