where are these "properties" stored?
Posted: Fri Jan 26, 2024 10:00 am
I was experimenting with Nirsoft's PropertySystemView and was a bit surprised that it displays many Windows System Properties for even a simple plain text file. I wonder where these properties are coming from. Since it's a plain text file, they aren't stored in the file's primary stream; nor are they in an alternate data stream. Maybe some of them are read from the other "attributes" stored in the file's MFT "file record segment". Or maybe they are generated by Windows Search indexer and stored in and drawn from the index? Or are they generated "on the fly" when PropertySystemView reads the file? Anybody have an idea?
Here's a screenshot, but a more complete view would be seen by dropping a random file into PropertySystemView.
Here's a screenshot, but a more complete view would be seen by dropping a random file into PropertySystemView.