1

The Microsoft documentation for NTFS describes the structure of an attribute. It shows it as follows:

typedef struct _ATTRIBUTE_RECORD_HEADER {
  ATTRIBUTE_TYPE_CODE TypeCode;
  ULONG               RecordLength;
  UCHAR               FormCode;
  UCHAR               NameLength;
  USHORT              NameOffset;
  USHORT              Flags;
  USHORT              Instance;
  union {
    struct {
      ULONG  ValueLength;
      USHORT ValueOffset;
      UCHAR  Reserved[2];
    } Resident;
    struct {
      VCN      LowestVcn;
      VCN      HighestVcn;
      USHORT   MappingPairsOffset;
      UCHAR    Reserved[6];
      LONGLONG AllocatedLength;
      LONGLONG FileSize;
      LONGLONG ValidDataLength;
      LONGLONG TotalAllocated;
    } Nonresident;
  } Form;
} ATTRIBUTE_RECORD_HEADER, *PATTRIBUTE_RECORD_HEADER;

The final member of a nonresident attribute, TotalAllocated, does not seem to exist. 3rd party documentation does not mention it, and actual NTFS filesystem do not contain such a member (the ValidDataLength is immediately followed by the the data runs, as specified in MappingPairsOffset.

From the documentation itself, it is supposed to record the total number of clusters (as opposed to the total number of bytes).

TotalAllocated

The total allocated for the file (the sum of the allocated clusters).

Does anyone recognize this?

Reinstate Monica
  • 588
  • 7
  • 21
  • AllocatedLength : is not always accurate (can be disregarded if lowestvcn member is non-zero). & "This value is an even multiple", this value is supposed to always be even. TotalAllocated: is just a raw sum of all the allocated clusters – Ian Elvister Feb 26 '21 at 13:00
  • @RamiMohammed; you're right. I missed the difference between clusters/bytes. My primary concern is that this field doesn't seem to exist. I will update the question – Reinstate Monica Feb 26 '21 at 14:03

1 Answers1

3

The field actually does exist, but only on compressed files (i.e. bit 1 on the Flags field is set); The MappingPairsOffset is then 0x48 instead of the usual 0x40 to make room for the extra field.

This is mentioned in a footnote to 3rd party NTFS documentation here.

Reinstate Monica
  • 588
  • 7
  • 21
  • The link's not working. Is this the same thing: https://flatcap.github.io/linux-ntfs/ntfs/concepts/attribute_header.html – Jere Kupari May 15 '23 at 18:50