Brief Intro
A file object provides a representation of a resource (either a physical device or a resource located on a physical device) that can be managed by the I/O system. Like other objects, they enable sharing of the resource, they have names, they are protected by object-based security, and they support synchronization. The I/O system also enables reading from or writing to the resource.
File Attributes
File attributes are metadata values stored by the file system on disk and are used by the system and are available to developers via various file I/O APIs. The following table lists file attribute constant names and values with descriptions.
Name (String Constant) |
Value (Dec) |
Value (Hex) |
Description |
FILE_ATTRIBUTE_ARCHIVE |
32 |
0x0020 |
A file or directory that is an archive file or directory. Applications typically use this attribute to mark files for backup or removal. |
FILE_ATTRIBUTE_COMPRESSED |
2048 |
0x0800 |
A file or directory that is compressed. For a file, all of the data in the file is compressed. For a directory, compression is the default for newly created files and subdirectories. |
FILE_ATTRIBUTE_DEVICE |
64 |
0x0040 |
This value is reserved for system use. |
FILE_ATTRIBUTE_DIRECTORY |
16 |
0x0010 |
The handle that identifies a directory. |
FILE_ATTRIBUTE_ENCRYPTED |
16384 |
0x4000 |
A file or directory that is encrypted. For a file, all data streams in the file are encrypted. For a directory, encryption is the default for newly created files and subdirectories. |
FILE_ATTRIBUTE_HIDDEN |
2 |
0x0002 |
The file or directory is hidden. It is not included in an ordinary directory listing. |
FILE_ATTRIBUTE_NORMAL |
128 |
0x0080 |
A file that does not have other attributes set. This attribute is valid only when used alone. |
FILE_ATTRIBUTE_NOT_CONTENT_INDEXED |
8192 |
0x2000 |
The file or directory is not to be indexed by the content indexing service. |
FILE_ATTRIBUTE_OFFLINE |
4096 |
0x1000 |
The data of a file is not available immediately. This attribute indicates that the file data is physically moved to offline storage. This attribute is used by Remote Storage, which is the hierarchical storage management software. Applications should not arbitrarily change this attribute. |
FILE_ATTRIBUTE_READONLY |
1 |
0x0001 |
A file that is read-only. Applications can read the file, but cannot write to it or delete it. This attribute is not honored on directories. |
FILE_ATTRIBUTE_REPARSE_POINT |
1024 |
0x0400 |
A file or directory that has an associated reparse point, or a file that is a symbolic link. |
FILE_ATTRIBUTE_SPARSE_FILE |
512 |
0x0200 |
A file that is a sparse file. |
FILE_ATTRIBUTE_SYSTEM |
4 |
0x0004 |
A file or directory that the operating system uses a part of, or uses exclusively. |
FILE_ATTRIBUTE_TEMPORARY |
256 |
0x0100 |
A file that is being used for temporary storage. File systems avoid writing data back to mass storage if sufficient cache memory is available, because typically, an application deletes a temporary file after the handle is closed. In that scenario, the system can entirely avoid writing the data. Otherwise, the data is written after the handle is closed. |
FILE_ATTRIBUTE_VIRTUAL |
65536 |
0x10000 |
This value is reserved for system use. |
Files and Clusters
A file is a unit of data in the file system that a user can access and manage. A file must have a unique name in its directory. It consists of one or more streams of bytes that hold a set of related data, plus a set of attributes (also called properties) that describe the file or the data within the file. The creation time of a file is an example of a file attribute. When a file is created, one unnamed default stream is created to store all data written to the file while it is open. You can also create additional streams within the file. These additional streams are referred to as alternate streams. The following figure depicts a file with the default stream and two alternate streams.
File attributes are not stored in the data streams with the file data, but are stored elsewhere and managed by the operating system. All file system data, including the system bootstrap code and directories, are stored by the NTFS file system in files. Other file systems store this information in disk regions external to the file system. An advantage of storing this information in files is that Windows can locate, access, and maintain the information easily. Other advantages are that each of these files may be protected by a security descriptor and, in the case of partial disk corruption, they may be quickly relocated to a safer part of the disk. The fundamental storage unit of all supported file systems is a cluster, which is a group of sectors. This allows the file system to optimize the administration of disk data independently of the disk sector size set by the hardware disk controller. If the disk to be administered is large and large amounts of data are moved and organized in a single operation, the administrator can adjust the cluster size to accommodate this. Windows manages files through file objects, file handles, and file pointers.