What do these chara...
 
Notifications
Clear all

What do these characters mean in X-Ways "Attr." column?

9 Posts
3 Users
0 Reactions
1,944 Views
(@skywalker)
Reputable Member
Joined: 10 years ago
Posts: 150
Topic starter  

The characters are "X", "S", "H", "A", "T", "R" and specially "#".

 

Thank you everybody!!


   
Quote
minime2k9
(@minime2k9)
Honorable Member
Joined: 13 years ago
Posts: 481
 

Might I suggest the X-Ways manual, all the attributes are documented in there under the "Attribute Legend". Typing that into the search function will provide your answers.

Edit: There is also the "Legend" view (Sits with File, Preview and Gallery views) that also contains the information.


   
ReplyQuote
(@skywalker)
Reputable Member
Joined: 10 years ago
Posts: 150
Topic starter  

@minime2k9 Thank you for your quick answer. I've checked the manual but character "#" is not explained, exceptt for "SC" previous characters. I would like to understand it when it is acompained to another characters.

 

Thanks!!


   
ReplyQuote
minime2k9
(@minime2k9)
Honorable Member
Joined: 13 years ago
Posts: 481
 

The Legend view does show you the details for the # character.

#: Contents only partially initialized


   
ReplyQuote
Satyendra
(@satyendra)
Active Member
Joined: 9 years ago
Posts: 17
 

The Legend is available in X-Ways UI.

 

https://ufile.io/lxaxmh2z


   
ReplyQuote
(@skywalker)
Reputable Member
Joined: 10 years ago
Posts: 150
Topic starter  

@minime2k9 

 

Thank you again. Maybe I have read an old version of the manual. But, in "easy" words, what does this mean? I mean, does it mean that there are information that couldn't be parsed? Maybe a parsing error? Maybe a file tampering?

 

Thanks!!

This post was modified 3 years ago by Skywalker

   
ReplyQuote
minime2k9
(@minime2k9)
Honorable Member
Joined: 13 years ago
Posts: 481
 

The information is not in the manual for some reason, but if you look at the screenshot posed by @Satyendra you would be able to see where it was in the program.

If you search for "Partial Initialization" in the X-Ways Manual, under the "Columns and Filters" section you will see the following:
.. means that according to the file system, the so-called valid data length is smaller than the logical size.

From what I can tell, this differs from a sparse file in that sparse clusters are recorded in the data runs, whereas a partially initialised file does not.


   
ReplyQuote
(@skywalker)
Reputable Member
Joined: 10 years ago
Posts: 150
Topic starter  

@minime2k9 Thanks for your reply, but I don't understand your explanation.

 

As far as I understand by "partial initialization", it seems the "real" file size stored in the filesystem is "smaller" than the size registered in the MFT for the file. Am I right?

Thanks!!


   
ReplyQuote
minime2k9
(@minime2k9)
Honorable Member
Joined: 13 years ago
Posts: 481
 

All the information (relating to this) is stored in the MFT. So the data runs are stored in the MFT File record relating to the file. Prior to the data runs, is a non-resident attribute header, see link below for details.

MFT Attribute Headers

As you can see, at offset 0x30 you have the real size of the file and 0x38 you have the initialised size of the file. Where a file has a # attribute, the real size is smaller than the logical size.

 


   
ReplyQuote
Share: