55. $AttrDef

• Located at inode #4 of the $MFT

• Contains list of attributes availble on this version of NTFS.

• For each attribute, the following info is provided:

  • Attribute name

  • ID

  • Usage rules (currently not in use)

  • Flags

    0x02 = Indexed
    0x40 = always Resident
    0x80 = can be Non-resident
    

  • Max size

  • Min size