Editing NTFS (section)

=== Attribute lists, attributes, and streams ===
For each file (or directory) described in the MFT record, there is a linear repository of stream descriptors (also named ''attributes''), packed together in one or more MFT records (containing the so-called ''attributes list''), with extra padding to fill the fixed 1&nbsp;KB size of every MFT record, and that fully describes the effective streams associated with that file.

Each attribute has an attribute type (a fixed-size integer mapping to an attribute definition in file {{mono|$AttrDef}}), an optional attribute name (for example, used as the name for an alternate data stream), and a value, represented in a sequence of bytes. For NTFS, the standard data of files, the alternate data streams, or the index data for directories are stored as attributes.

According to {{mono|$AttrDef}}, some attributes can be either resident or non-resident. The {{mono|$DATA}} attribute, which contains file data, is such an example. When the attribute is resident (which is represented by a flag), its value is stored directly in the MFT record. Otherwise, clusters are allocated for the data, and the cluster location information is stored as data runs in the attribute.
* For each file in the MFT, the attributes identified by ''attribute type, attribute name'' must be unique. Additionally, NTFS has some ordering constraints for these attributes.
* There is a predefined null attribute type, used to indicate the end of the list of attributes in one MFT record. It must be present as the last attribute in the record (all other storage space available after it will be ignored and just consists of padding bytes to match the record size in the MFT).
* Some attribute types are required and must be present in each MFT record, except unused records that are just indicated by null attribute types.
** This is the case for the {{mono|$STANDARD_INFORMATION}} attribute that is stored as a fixed-size record and contains the [[timestamp]]s and other basic single-bit attributes (compatible with those managed by [[File Allocation Table|FAT]] in DOS or [[Windows 9x]]).
* Some attribute types cannot have a name and must remain anonymous.
** This is the case for the standard attributes, or for the preferred NTFS "filename" attribute type, or the "short filename" attribute type, when it is also present (for compatibility with DOS-like applications, see below). It is also possible for a file to contain only a short filename, in which case it will be the preferred one, as listed in the Windows Explorer.
** The filename attributes stored in the attribute list do not make the file immediately accessible through the [[hierarchical file system]]. In fact, all the filenames must be indexed separately in at least one other directory on the same volume. There it must have its own MFT record and its own [[security descriptor]]s and attributes that reference the MFT record number for this file. This allows the same file or directory to be "hardlinked" several times from several containers on the same volume, possibly with distinct filenames.
* The default data stream of a regular file is a stream of type {{mono|$DATA}} but with an anonymous name, and the ADSs are similar but must be named.
* On the other hand, the default data stream of directories has a distinct type, but are not anonymous: they have an attribute name ("{{mono|$I30}}" in NTFS 3+) that reflects its indexing format.

All attributes of a given file may be displayed by using the nfi.exe ("NTFS File Sector Information Utility") that is freely distributed as part of the Microsoft "OEM Support Tools".<ref name="support.microsoft.com"/>

Windows system calls may handle alternate data streams.<ref name="How NTFS Works"/> Depending on the operating system, utility and remote file system, a file transfer might silently strip data streams.<ref name="How NTFS Works"/> A safe way of copying or moving files is to use the BackupRead and BackupWrite system calls, which allow programs to enumerate streams, to verify whether each stream should be written to the destination volume and to knowingly skip unwanted streams.<ref name="How NTFS Works"/>