45. The $BITMAP Attribute

• Type 0xB0 -- used with $INDEX_ALLOCATION attributes and in $MFT entries

• Contains string of bits that correlates to a set of records

• Purpose: to show which entries are in use and which are free

• Note that individual entries in $MFT have their own marking of free or in use, but bitmaps allow for quick view of the whole structure with multiple records.

• This attribute is named so the bitmap is correlated to a specific index, since some files with indexes can have multiple indexes.

• For example, a bitmap

      0x7FFF =
      0111111111111111 =
  

  means that the first entry is not is use; next 15 are in use.