40. The $VOLUME_INFORMATION Attribute

• Type 0x70 -- contains info about the volume:

  • NTFS version number, e.g. 1.2 or 3.1 NTFS version

  • Flags:

     Value  Description
     ------ -------------------
     0x0001 Dirty
     0x0002 Resize LogFile
     0x0004 Upgrade on Mount
     0x0008 Mounted on NT4
     0x0010 Delete USN underway
     0x0020 Repair Object Ids
     0x8000 Modified by chkdsk
    

    If the dirty flag is set, on the next reboot chkdsk /f will run.