5.2 NTFS Attribute Types

On a NTFS volume, each unit of information associated with a file including its name, its owner, its timestamp, its contents, and so on, is implemented as a file attribute. A file's data is an attribute; the "Data Attribute" known as $DATA. A number of attributes exist on a NTFS volume. The attribute names used by NTFS are listed in the table below.

Attribute Name



Lists the location of all attribute records that do not fit in the MFT record


Attribute for Bitmaps


Contains the default file data


Extended the attribute index


Extended attribute information


File name


The type name for a Directory Stream. A string for the attribute code for index allocation


Used to support folders and other indexes


Use by the encrypting file system


Unique GUID for every MFT record




Used for volume mount points


Security descriptor stores ACL and SIDs


Standard information, such as file times and quota data




Transactional NTFS data


Version and state of the volume


Name of the volume


Obsolete. Volume version

A comprehensive discussion and explanation about attributes is available in [WININTERNALS]   Chapter 12 and [MSFT-NTFSWorks].