NTFS Extended Attributes, how it works

Question

Hi Heroes,

Maybe a dumb question but I have been struggling to understand how exactly NTFS Extended Attributes works.
I'm studying the Data Loss Prevention(DLP) products (like Symantec, McAfee, Forcepoint DLP products). and in the DLP products, there has a mechanism that the DLP can insert a Classification ID into the file to classify the file, so that even the file is sent out to another PC, the DLP still can track the file if the target PC installs DLP software as well.
I want to know how is the Classification ID embedded into the file, googled this a lot but still unsure of this...... thanks in advance.

Answer 1

Hi,
In NTFS the file metadata is stored in the master file table (MFT). There is at least one record in the MFT for every file on an NTFS file system volume. Each record consists of the attributes of a file, such as the file name, timestamp, security descriptor, and the extended attributes. The extended attributes are defined by programs. According to your description, if your DLP product adds an extended attribute called Classification ID to a file, it's inserted not into the file itself, but into the mft record that points to the file.

For more details about MFT you may refer to these links
https://learn.microsoft.com/en-us/windows/win32/fileio/master-file-table
http://ntfs.com/ntfs-mft.htm

Best Regards,
Ian

----------

Please remember to "Accept Answer" and upvote if the reply is helpful.