41. The $DATA Attribute

• Type 0x80 -- contains the actual file content -- user data

• Can be any of the four possible attribute types:

  • Resident and Named

  • Resident and Unnamed (if the file is small enough to fit in MFT entry)

  • Non-Resident and Named

  • Non-Resident and Unnamed (most common)