| Home | Files | Attributes | Concepts | Glossary | Help |
| Type | Description | Name |
|---|---|---|
| 0x10 | $STANDARD_INFORMATION | |
| 0x30 | $FILE_NAME | $UsnJrnl |
| 0x80 | $DATA | $J |
| 0x80 | $DATA | $Max |
repeating group
| Offset | Size | Description |
|---|---|---|
| 0x00 | 4 | Size of entry |
| 0x04 | 4 | ? (Always 0x02) |
| 0x08 | 8 | MFT Reference 1 |
| 0x10 | 8 | MFT Reference 2 |
| 0x18 | 8 | Offset of this entry in $J |
| 0x20 | 8 | Timestamp |
| 0x28 | 8 | Flags? (bitfield?) |
| 0x30 | 8 | Flags? (bitfield?) |
| 0x38 | 2 | Size of filename (in bytes) |
| 0x3A | 2 | Offset to filename |
| 0x3C | V | Filename |
| V+0x3C | P | Padding (align to 8 bytes) |
one block -- fixed size?
| Offset | Size | Description |
|---|---|---|
| 0x00 | 8 | ? |
| 0x08 | 8 | ? |
| 0x10 | 8 | Time |
| 0x18 | 8 | ? |