Below is a list of NTFS “Attributes”. An NTFS attribute is an OPTIONAL setting that software MIGHT use to make smart decisions as to how to handle a particular file.
For instance, if file is marked as “O” that means is its OFFLINE. An offline file might be available on Azure File Sync meaning that the file is actually stored in the Azure cloud but your local PC or file server has a link to it. Given that it is in the cloud, it should be given extra time to download and an intelligent program would take that into consideration before timing out.
It is possible for files to have combinations of attributes. For example:
- APLO = Archive, Sparse, Reparse, Offline – this is common with Azure File Sync
- HSA = Hidden, System, Archive – this is common with standard local Windows OS files
To see the file attributes in the Windows GUI, just right click on a column title, select MORE, then select ATTRIBUTES and click OK.
NTFS ATTRIBUTE DEFINITIONS:
A = Archive: This is a special bit that is used as a “communications link” between software applications that modify files, and those that are used for backup. Most backup software allows the user to do an incremental backup, which only selects for backup any files that have changed since the last backup. This bit is used for this purpose. When the backup software backs up (“archives”) the file, it clears the archive bit (makes it zero). Any software that modifies the file subsequently, is supposed to set the archive bit. Then, the next time that the backup software is run, it knows by looking at the archive bits which files have been modified, and therefore which need to be backed up. Again, this use of the bit is “voluntary”; the backup software relies on other software to use the archive bit properly; some programs could modify the file without setting the archive attribute, but fortunately most software is “well-behaved” and uses the bit properly. Still, you should not rely on this mechanism absolutely to ensure that your critical files are backed up.
C = Compressed: This is a compressed file or folder that cannot be encrypted.
D = Directory: This is the bit that differentiates between entries that describe files and those that describe subdirectories within the current directory. In theory you can convert a file to a directory by changing this bit. Of course in practice, trying to do this would result in a mess–the entry for a directory has to be in a specific format.
E = Encrypted: This is an encrypted file or folder that cannot be compressed.
H = Hidden: This one is pretty self-explanatory as well; if the file is marked hidden then under normal circumstances it is hidden from view. DOS will not display the file when you type “DIR” unless a special flag is used, as shown in the earlier example.
I = Not content indexed: This file may be indexed by search services but the contents of the file are not.
L = Reparse Points: This means it is only a LINK to another location
N = Not Indexed: The file is not included in the search services index.
O = Offline: This means it is not stored locally. Perhaps it is in Azure File Sync so your machine only has a link to it
P = Sparse File: This makes disk space usage more efficient. When sparse file functionality is enabled, the system does not allocate hard disk drive space to a file except in regions where it contains nonzero data. When a write operation is attempted where a large amount of the data in the buffer is zeros, the zeros are not written to the file. Instead, the file system creates an internal list containing the locations of the zeros in the file, and this list is consulted during all read operations. You might find THIS and THIS interesting.
R = Read-Only: Most software, when seeing a file marked read-only, will refuse to delete or modify it. This is pretty straight-forward. For example, DOS will say “Access denied” if you try to delete a read-only file. On the other hand, Windows Explorer will happily munch it. Some will choose the middle ground: they will let you modify or delete the file, but only after asking for confirmation.
S = System: This flag is used to tag important files that are used by the system and should not be altered or removed from the disk. In essence, this is like a “more serious” read-only flag and is for the most part treated in this manner. It is also a “super-hidden” attribute. Even if you enable “Show hidden files”, system files will not be displayed. (You can display them by disabling “Hide protected operating system files.”)
T = Temporary: The file is marked as non-permanent. Many pieces of software (like backup software) will ignore files with the T attribute.
Some of the text was taken from THIS PC Mag article.
0 Comments