36. The $FILE_NAME Attribute

• Type 0x30 -- contains

  • the inode number of the parent directory that contains this file. Parent Directory Reference has two parts:

    • 6 bytes for the inode number of the parent, and

    • 2 bytes for an internal sequence number for NTFS integrity checks

  • Timestamps are repeated -- the same as in $STANDARD_INFORMATION, but here the timestamps are often out of sync:

    • they are not updated unless the file name changes

    • only if the file is renamed, the times are also updated.

  • File size (file length)

    • both the actual size of the file, and

    • the amount of disk space allocated -- the actual size + cluster slack are recorded.

  • Flags -- the same as in $STANDARD_INFORMATION

  • The name of the file. After the name, the entry is padded with 0x00 to an even 8 byte cutoff point.

  • NOTE: If 8.3 file name creation is turned on, any files with long names will have a second $FILE_NAME attribute that contains the short name.