Attributes
The per-attribute reference — the metadata an object can carry, by embedded type code.
The ones that matter most forensically: $STANDARD_INFORMATION (timestamps,
file attributes, the USN / LastUsn link), $DATA (file content — resident inline or
non-resident extents), $FILE_NAME, and $INDEX_ROOT. Reparse points
(symlinks / junctions), WSL / Linux metadata ($LX*), extended attributes, and EFS encryption metadata
are documented here too.
| $DATA | $DATA# $DATA is a file’s default data stream (embedded type 0x80, schema 0x180). It is stored either resident (content inline in the B+-tree row) or non-resident … |
| $EA_INFORMATION and $EA | $EA_INFORMATION and $EA# Extended attributes (EAs) on ReFS are a two-part structure: $EA_INFORMATION (embedded type 0xD0, schema 0x1D0; v3.7+) is the size index, and $EA … |
| $EFS | $EFS# $EFS is the Windows Encrypting File System metadata for an encrypted file. ReFS stores it as a single $LOGGED_UTILITY_STREAM attribute (schema 0x200, embedded type … |
| $I30_INDEX | $I30_INDEX# Naming note: this page documents the embedded type-0x90 $I30_INDEX directory-index config template. The legacy/alias name $I30 (the directory-index stream … |
| $NAMED_DATA | $NAMED_DATA# $NAMED_DATA is ReFS’s named (alternate) data stream — ADS. Unlike NTFS, which uses named $DATA attributes, ReFS stores ADS as multi-instance … |
| $OBJ_LINK | $OBJ_LINK# $OBJ_LINK is the object → primary-name backpointer — it stores a file’s canonical filename and parent OID directly in the object’s own type-0x10 … |
| $REPARSE (Reparse Index) | $REPARSE (Reparse Index)# $REPARSE (schema 0x160, embedded type 0x60) is the reparse-point index attribute — the schema for the global reparse index stored in the system … |
| $REPARSE_POINT | $REPARSE_POINT# $REPARSE_POINT stores the inline REPARSE_DATA_BUFFER for a reparse point — a symlink, junction, mount point, or WSL special file (embedded type 0xC0, … |
| $SNAPSHOT | $SNAPSHOT# $SNAPSHOT is the per-stream snapshot metadata for file versioning (embedded type 0xB0, schema 0x1B0; v3.7+). A snapshot freezes a stream’s current … |
| $STANDARD_INFORMATION ($SI) | $STANDARD_INFORMATION ($SI)# $STANDARD_INFORMATION ($SI) is the most forensically important attribute — every file and directory has exactly one, carrying all timestamps, … |
| $VOLUME_INFORMATION | $VOLUME_INFORMATION# $VOLUME_INFORMATION (schema 0x150, embedded type 0x50) is the volume-level metadata — version, flags, label, and timestamps. Despite being registered … |