| <<< NTFS Timestamps | Index | The $FILE_NAME Attribute >>> |
Type 0x20 -- if the are a lot of resident attributes and not enough space to fit them in the MFT record, they are moved into another MFT record. The $ATTRIBUTE_LIST specifies how to find these additional MFT records.
This is a quite rare attribute, a couple examples might be
A large file can be extremely fragmented, requiring very long runlist of data runs
A file has a lot of named streams
| <<< NTFS Timestamps | Index | The $FILE_NAME Attribute >>> |