Attributes
The per-attribute reference — the metadata an object can carry, by embedded type code.
The ones that matter most forensically: $STANDARD_INFORMATION (timestamps, file
attributes, the USN / LastUsn link) and $DATA (file content — inline bytes or on-disk
extents). Unlike NTFS, ReFS has no $FILE_NAME attribute — a name is a directory-entry row, not a
per-file attribute — and no 8.3 short-name twin; a directory’s child index is the embedded
$I30_INDEX. Reparse points (symlinks / junctions), WSL / Linux metadata ($LX*), extended
attributes, alternate data streams, stream snapshots, and EFS encryption metadata are documented here too.
$DATA is a file's default data stream (embedded type 0x80, schema 0x180). Its bytes are stored either inline in the B+-tree row or in on-disk extents, and which is a property of the volume format:
Extended attributes (EAs) on ReFS are a two-part structure: $EA_INFORMATION (embedded type 0xD0, schema 0x1D0; v3.7+) is the size index, and $EA (embedded type 0xE0, schema 0x1E0; v3.14+) is the body — a standard NT…
$EFS is the Windows Encrypting File System metadata for an encrypted file. ReFS stores it as a single $LOGGED_UTILITY_STREAM attribute (schema 0x200, embedded type 0x100) whose stream name is $EFS. It holds the standard…
$I30_INDEX (embedded type 0x90, schema 0x190) is the B+-tree index configuration template for a directory's "$I30" entry index. Every directory-bearing object — the root directory (OID 0x600) and every user OID ≥ 0x701…
$NAMED_DATA is ReFS's named (alternate) data stream — ADS. Unlike NTFS, which uses named $DATA attributes, ReFS stores ADS as multi-instance sub-records (embedded type 0xB0) inside the directory-entry value. On a format…
$OBJ_LINK is the object → name backpointer — it stores a filename and its parent OID directly in the object's own record, so a path can be reconstructed from the Object Table alone, without walking directory trees. It…
$REPARSE (embedded type 0x60, schema 0x160) is the reparse-point index — the schema behind the global reparse index ReFS keeps in the system table at OID 0x540, with a byte-identical failover mirror at 0x541. It is…
$REPARSE_POINT stores the inline REPARSE_DATA_BUFFER for a reparse point — a symlink, junction, mount point, or WSL special file (embedded type 0xC0, schema 0x1C0; the v3.7+ "v2" format). It appears as a single-instance…
$SNAPSHOT is the per-stream snapshot metadata for file versioning (embedded type 0xB0, schema 0x1B0; v3.7+). A snapshot freezes a stream's current content under a new stream-set id, so the prior bytes survive later…
$STANDARD_INFORMATION ($SI) is the most forensically important attribute — every file and directory has exactly one, carrying all timestamps, the file attributes, the SecurityId, and the per-file USN link. Structurally…
$VOLUME_INFORMATION (schema 0x150, embedded type 0x50) is the volume-level metadata — version, flags, label, and timestamps. Despite being registered as an attribute schema, it does not appear as an embedded sub-record…