$STANDARD_INFORMATION ($SI)#

$STANDARD_INFORMATION ($SI) is the most forensically important attribute — every file and directory has exactly one, carrying all timestamps, the file attributes, the SecurityId, and the per-file USN link. Structurally it is not an embedded sub-record: it occupies the fixed region of the object’s type-0x10 own-row value (read $SI only from a type-0x10 row). Its layout differs between v3.4 and v3.7+ in a non-backward-compatible way — the same byte offsets mean different things by version, so a parser must know the version first.

Value layout#

Common fields (all versions, 0x00–0x57)#

v3.4 extension (Win10) — total 116 bytes (0x74)#

v3.7+ extension (Win11) — total 124 bytes (0x7C)#

The mapper enforces the size: a Win10 driver requires value > 0x73 (≥116 B), a Win11 driver requires value > 0x7b (≥124 B) — which is why a Win11 driver rejects a Win10-sized $SI.

Internal flags#

A 6-bit field at $SI+0x24, 0 on v3.4–v3.10, active on v3.14+. Bits 0–3 are computed by RefsComputeStandardInformationInternalFromFcb (from FCB+0x08); bits 4–5 are added by the caller via (FCB[0xf4] << 4) & 0x30.

LastUsn / UsnJournalId#

$SI+0x40 and $SI+0x48 are the USN change-journal fields — written atomically (both zero or both non-zero), and non-zero only on a volume with an active USN journal (v3.14+):

• $SI+0x40 = LastUsn — the byte offset of the file’s most recent record in $UsnJrnl:$J, taken from the journal write cursor (VCB+0x3a0) and cached in FCB+0xe0. Always 8-byte aligned.
• $SI+0x48 = UsnJournalId — a FILETIME identifying the journal instance (VCB+0x388), one distinct value per volume. It does not change when the journal is re-created: measured on lab314_main, fsutil usn createjournal restarted USNs at 0 under the same id, so this field cannot be used to detect that a stale LastUsn now points into a different numbering epoch.
• The pair is gated by FCB bit 23 (“the cached LastUsn is valid for the current journal epoch”: set only when the journal is active and the on-disk UsnJournalId matches the current journal — a stale-epoch check, like NTFS journal-ID validation). Both are written by RefsWriteFcbUsnRecordToJournal.

NextFileId ordinal#

$SI+0x58 (also ExternalFileId_1 on v3.4) is the directory child-creation ordinal: a directory’s own-row holds NextFileId = max(child ordinal), and each resident child’s $SI+0x58 is its assigned ordinal. RefsMoveFile (the unified create/rename/link path) increments the parent directory’s NextFileId and stamps the child. It is persisted to the own-row only when version < 0x30b (v3.11) — so on native v3.14 the own-row reads 0 while the object-record payload carries it. A fresh directory starts at 1 (0/1 reserved); child ordinals are near-contiguous from 2. The counter is increment-only — a deleted child’s ordinal is never re-used (it stays a permanent gap), so a file’s reference (directory OID, ordinal) is stable over time — never reassigned to a later file — which USN correlation relies on. It is not a per-write counter.

The two “0x90"s — $SI is not $I30_INDEX#

A common trap: $SI is the type-0x10 own-row’s fixed region, and its schema slot is historically labeled 0x190 / embedded code 0x90. But the embedded type-0x90 sub-record is $I30_INDEX (the directory-index template), a different thing. Read $SI only from a type-0x10 row — a top-level type-0x90 row is $I30_INDEX, not $SI. See $I30_INDEX.

Driver functions#

• RefsMapStandardInfo — maps $SI from a B+-tree row (and enforces the min-size gate)
• RefsGetStandardInfo / RefsSetStandardInfo — read / write (RefsSetStandardInfo via MsUpdateDataWithRoot)
• RefsComputeStandardInformationFromFcb — builds $SI from the in-memory FCB state

Forensic value#

Timestomping detection. ReFS carries one $SI timestamp set per name. For a single-named file there is no NTFS-style $SI-vs-$FN twin to compare — but a hard-linked file has one independent timestamp copy per name, and those copies can hold different times — where NTFS’s hard links share a single $SI and cannot diverge at all. Divergence between a file’s names is evidence worth following. Agreement is not: calling SetFileTime through one name was measured to leave both name rows byte-identical across their whole value, so every name is updated at once. Which name holds the true birth is not established. For any file, timestomping is also detectable via the metadata-change time ($SI+0x10) (left at the real write moment by the high-level APIs that timestomp tools use), the USN journal (records the edit and the true create time — the stronger anchor), and the volume creation time (a hard lower bound). See Timestomping Detection.

Last access time. ReFS does not update last-access on read by default (RefsDisableLastAccessUpdate defaults to 1). Per-handle suppression bits at CCB+4 (bit 6 access / bit 5 modify / bit 4 change) are the in-driver timestomp-suppression bits, set when a caller supplies an explicit time via SetFileTime.

Raw example#

A $STANDARD_INFORMATION value on a v3.14 image (a file created and untouched, so all four stamps match), value-relative offsets:

+0x00:  92 10 67 69 18 e6 dc 01    <- Created   (FILETIME)  2026-05-17 16:15
+0x08:  92 10 67 69 18 e6 dc 01    <- Modified  (FILETIME)
+0x10:  92 10 67 69 18 e6 dc 01    <- Changed   (FILETIME)
+0x18:  92 10 67 69 18 e6 dc 01    <- Accessed  (FILETIME)
+0x20:  00 00 00 00 00 00 00 00
+0x28:  62 9b 9f 0a 01 00 00 00    <- SecurityId 0x10a9f9b62 (resolves in the security table, OID 0x530)

The four 8-byte FILETIMEs sit at 0x00 / 0x08 / 0x10 / 0x18; SecurityId is the u32 at 0x28. (ReFS carries one timestamp set per name — there is no NTFS-style $FILE_NAME duplicate, but a hard-linked file has one such set per name, and those can diverge under a name-scoped timestomp.)

Cross-references#

• Directory Entries — $SI fields are embedded in resident values
• $I30_INDEX — the other type-0x90 thing $SI is confused with
• $EA_INFORMATION and $EA — the PackedEaSize at 0x50 (v3.10+)
• Security Descriptors — the SecurityId at 0x28 (OID 0x530)
• Version Detection — detect the version before parsing $SI

Evidence#

The $SI layout, the version split, the internal-flag bits, and the USN / NextFileId resolutions are confirmed in the decompiled driver (RefsComputeStandardInformationFromFcb, RefsComputeStandardInformationInternalFromFcb, RefsWriteFcbUsnRecordToJournal, RefsMoveFile) and raw-disk decoded across the corpus. The per-name MACB timestomp cross-check is proven on disk on a hard-link pair. The remaining field-level statements on this page are registered as — each with its own evidence tier and witness in the claim register. Prior work tabulated these fields twice — once as a File Table and once as a Directory Descriptor — and both sets describe this one structure, since a file’s $SI and a directory’s $SI share the layout: duplicate. Both are kept in the register because each records a distinct source table.