54. $Volume

• Located at inode #3 of the $MFT

• Contains

  • NTFS volume name

  • NTFS version number

  • Flags to signal operations to performed on boot:

    • run CHKDSK

    • upgrade to new version

    • resize the log file

  • contains VOLUME_INFORMATION attribute, which provides

    • major (1 or 3) and a minor version number of NTFS

    • flags:

       Value   Description
       ------  -------------------
       0x0001  Dirty (chkdsk /f needs to be run on the next boot)
       0x0002  Resize LogFile
       0x0004  Upgrade on Mount
       0x0008  Mounted on NT4
       0x0010  Delete USN underway
       0x0020  Repair Object Ids
       0x8000  Modified by chkdsk