What do these chara...
 
Notifications
Clear all

What do these characters mean in X-Ways "Attr." column?

9 Posts
3 Users
0 Likes
1,827 Views
(@skywalker)
Posts: 152
Reputable Member
Topic starter
 

The characters are "X", "S", "H", "A", "T", "R" and specially "#".

 

Thank you everybody!!

 
Posted : 26/08/2021 2:22 am
minime2k9
(@minime2k9)
Posts: 481
Honorable Member
 

Might I suggest the X-Ways manual, all the attributes are documented in there under the "Attribute Legend". Typing that into the search function will provide your answers.

Edit: There is also the "Legend" view (Sits with File, Preview and Gallery views) that also contains the information.

 
Posted : 26/08/2021 6:03 am
(@skywalker)
Posts: 152
Reputable Member
Topic starter
 

@minime2k9 Thank you for your quick answer. I've checked the manual but character "#" is not explained, exceptt for "SC" previous characters. I would like to understand it when it is acompained to another characters.

 

Thanks!!

 
Posted : 26/08/2021 10:16 am
minime2k9
(@minime2k9)
Posts: 481
Honorable Member
 

The Legend view does show you the details for the # character.

#: Contents only partially initialized

 
Posted : 26/08/2021 10:24 am
Satyendra
(@satyendra)
Posts: 17
Active Member
 

The Legend is available in X-Ways UI.

 

https://ufile.io/lxaxmh2z

 
Posted : 26/08/2021 10:56 am
(@skywalker)
Posts: 152
Reputable Member
Topic starter
 

@minime2k9 

 

Thank you again. Maybe I have read an old version of the manual. But, in "easy" words, what does this mean? I mean, does it mean that there are information that couldn't be parsed? Maybe a parsing error? Maybe a file tampering?

 

Thanks!!

This post was modified 3 years ago by Skywalker
 
Posted : 26/08/2021 2:48 pm
minime2k9
(@minime2k9)
Posts: 481
Honorable Member
 

The information is not in the manual for some reason, but if you look at the screenshot posed by @Satyendra you would be able to see where it was in the program.

If you search for "Partial Initialization" in the X-Ways Manual, under the "Columns and Filters" section you will see the following:
.. means that according to the file system, the so-called valid data length is smaller than the logical size.

From what I can tell, this differs from a sparse file in that sparse clusters are recorded in the data runs, whereas a partially initialised file does not.

 
Posted : 28/08/2021 5:54 am
(@skywalker)
Posts: 152
Reputable Member
Topic starter
 

@minime2k9 Thanks for your reply, but I don't understand your explanation.

 

As far as I understand by "partial initialization", it seems the "real" file size stored in the filesystem is "smaller" than the size registered in the MFT for the file. Am I right?

Thanks!!

 
Posted : 29/08/2021 12:58 am
minime2k9
(@minime2k9)
Posts: 481
Honorable Member
 

All the information (relating to this) is stored in the MFT. So the data runs are stored in the MFT File record relating to the file. Prior to the data runs, is a non-resident attribute header, see link below for details.

MFT Attribute Headers

As you can see, at offset 0x30 you have the real size of the file and 0x38 you have the initialised size of the file. Where a file has a # attribute, the real size is smaller than the logical size.

 

 
Posted : 31/08/2021 6:48 am
Share: