59. NTFS Directory Attributes

• $INDEX_ROOT:

  • is a resident attribute of a directory entry

  • stores a single node with a small number of index entries.

  • Always the root of the index tree

• $INDEX_ALLOCATION:

  • is a non-resident attribute of a directory entry (due to a potentially large index structure.)

  • Stores as many index records as required for directory

  • Each index record is usually 4,096 bytes in size