1 System files mft record numbers. All these files are always marked as used
2 in the bitmap attribute of the mft; presumably in order to avoid accidental
3 allocation for random other mft records. Also, the sequence number for each
4 of the system files is always equal to their mft record number and it is
5 never modified. (Only $MFT has a sequence number of 1, rather than 0.)
7 FILE_$MFT = 0, /* Master file table (mft). Data attribute
8 contains the entries and bitmap attribute
9 records which ones are in use (bit==1). */
10 FILE_$MFTMirr = 1, /* Mft mirror (copy of first four mft records)
12 FILE_$LogFile = 2, /* Journalling log in data attribute. */
13 FILE_$Volume = 3, /* Volume name attribute and volume information
14 attribute (flags and ntfs version). Windows
15 refers to this file as volume DASD (Direct
16 Access Storage Device). */
17 FILE_$AttrDef = 4, /* Array of attribute definitions in data
19 FILE_$root = 5, /* Root directory. */
20 FILE_$Bitmap = 6, /* Allocation bitmap of all clusters (lcns) in
22 FILE_$Boot = 7, /* Boot sector (always at cluster 0) in data
24 FILE_$BadClus = 8, /* Contains all bad clusters in the non-resident
26 FILE_$Secure = 9, /* Shared security descriptors in data attribute
27 and two indexes into the descriptors.
28 Appeared in Windows 2000. Before that, this
29 file was named $Quota but was unused. */
30 FILE_$UpCase = 10, /* Uppercase equivalents of all 65536 Unicode
31 characters in data attribute. */
32 FILE_$Extend = 11, /* Directory containing other system files (eg.
33 $ObjId, $Quota, $Reparse and $UsnJrnl). This
35 FILE_reserved12 = 12, /* Reserved for future use (records 12-15). */
39 FILE_first_user = 16, /* First user file, used as test limit for
40 whether to allow opening a file or not. */