fileparsingattributesntfsntfs-mft

Understanding the $ATTRIBUTE_LIST in NTFS

I'm examining the NTFS (New Technology File System) and have been stuck in a loop trying to figure out the $ATTRIBUTE_LIST attribute. From this documentation, it is unusual to come across an $ATTRIBUTE_LIST and they're only used if the MFT table is running out of room. However, from looking at the following parsers, I've found they do parse it:

From looking at these, I've come up with the following flowchart:

Attribute List Flow Chart

(There should be a yes to the right of "Has $ATTRIBUTE_LIST")

I would like to refer to the 2 processes on the right side of the flow chart. Is it correct that:

  1. The attribute is only parsed if it's FRN is different than the file containing the attribute lists FRN?
  2. The attribute is added to the file with the FRN listed in the attribute and not the FRN containing the attribute list? Or, is the FRN listed in the attribute only used for attributes for this file record (and not really a file)?
Solution

  • they're only used if the MFT table is running out of room

    This is not correct. They are used whenever the MFT entry is too large to hold all the attributes.

    The attribute is only parsed if it's FRN is different than the file containing the attribute lists FRN?

    It depends on the OS/software, I guess, but it kinda makes sense. While $ATTRIBUTE_LIST must contain a list of all attributes, you can enumerate "local" attributes by simply parsing the whole MFT entry. For instance, my software RecuperaBit does it that way.

    Conversely, you need the list to figure out in which other MFT entries the "remote" attributes are stored.

    Or, is the FRN listed in the attribute only used for attributes for this file record (and not really a file)?

    The MFT entry whose number is contained in the $ATTRIBUTE_LIST attribute does not contain a $DATA attribute and doesn't have a $FILE_NAME attribute either. It is not a file, it's just an additional MFT entry.

    Note: I edited the answer because I was using the word "resident" in a confusing way to refer to attributes inside the base MFT entry. However, the concept of resident attribute is a different thing.