[EvanAnderson]

Help me understand the terminology. I thought alternative data streams were just non-resident attributes. Attributes like "$SECURITY_DESCRIPTOR" have reserved names but, conceptually, I thought were stored in the same manner as an alternative data stream. (Admittedly, I've never seen the real NTFS source code-- I've only perused open source tools and re-implementations.)

[p_l]

Essentially, attribute names directly specify the attribute type - so $SECURITY_DESCRIPTOR declared the entry in FILE attribute list to be a security descriptor. DATA attributes have another name field to handle multiple instances

[skissane]

> Essentially, attribute names directly specify the attribute type - so $SECURITY_DESCRIPTOR declared the entry in FILE attribute list to be a security descriptor. DATA attributes have another name field to handle multiple instances

If you at the Linux kernel source code, `fs/ntfs3/ntfs.h` contains the following:

    struct ATTRIB {
        enum ATTR_TYPE type; // 0x00: The type of this attribute.
        __le32 size;         // 0x04: The size of this attribute.
        u8 non_res;          // 0x08: Is this attribute non-resident?
        u8 name_len;         // 0x09: This attribute name length.
        __le16 name_off;     // 0x0A: Offset to the attribute name.
        __le16 flags;        // 0x0C: See ATTR_FLAG_XXX.
        __le16 id;           // 0x0E: Unique id (per record).
        union {
            struct ATTR_RESIDENT res;     // 0x10
            struct ATTR_NONRESIDENT nres; // 0x10
        };
    };

So the name field isn't specific to `$DATA` attributes, every attribute has it. However, for most attributes either the name is zero bytes, or it is a hardcoded name (like `$I30` for directories). Is `$DATA` the only one that can have different instances of the attribute with arbitrary names?

[p_l]

Arguably from the point of On Disk Structure (to reuse terminology from NTFS' ancestor in VMS), all attributes can have names as well.

Now, implementation in ntfs.sys is another thing and I have no idea if it's just an unused code path or if something would explode, and from what I heard Microsoft ended up in situation where people are scared to touch it not because of code quality but because of being scared of breaking something.

[skissane]

> Now, implementation in ntfs.sys is another thing and I have no idea if it's just an unused code path or if something would explode,

ntfs.sys has validation checks in it which prevent you from directly creating anything other than named or unnamed $DATA attributes on a regular file, and named $DATA attributes on a directory, and (indirectly) creating other stuff (directories, file names, standard attributes, EAs) through the appropriate APIs. If you try to do anything funky, you'll get an "Access Denied" error code returned by ntfs.sys

[p_l]

I was thinking more of "ntfs.sys encounters filesystem structure with names set for normally unnamed attributes".

The API preventing arbitrary messing up is a separate (and good and valid) concern.

[skissane]

> I was thinking more of "ntfs.sys encounters filesystem structure with names set for normally unnamed attributes".

From reading the source code of the Linux kernel NTFS driver (the ntfs3 one in the latest Linux kernel, not the older one it replaced), its (pretty reasonable) strategy is just to ignore things it doesn't expect. But I don't know what ntfs.sys does in such a scenario, I've never tried.

[EvanAnderson]

I see. So there's one more layer of indirection there that I'm missing.