Decode “Attributes/FileAttributes” value in ProcMon output

The procmon output shows some shortcut for “Attributes” value. Something like this in the picture down.

image

This value is(Attributes: ANCI) generated out of the value “FileAttributes” variable.

Here is the direct mapping.

#define FILE_ATTRIBUTE_READONLY                              0x00000001  -> R
#define FILE_ATTRIBUTE_HIDDEN                                     0x00000002  -> H
#define FILE_ATTRIBUTE_SYSTEM                                     0x00000004  -> S
#define FILE_ATTRIBUTE_DIRECTORY                              0x00000010  -> D
#define FILE_ATTRIBUTE_ARCHIVE                                   0x00000020  -> A
#define FILE_ATTRIBUTE_DEVICE                                       0x00000040  -> D
#define FILE_ATTRIBUTE_NORMAL                                   0x00000080  -> N
#define FILE_ATTRIBUTE_TEMPORARY                            0x00000100  -> T
#define FILE_ATTRIBUTE_SPARSE_FILE                           0x00000200  -> SF
#define FILE_ATTRIBUTE_REPARSE_POINT                     0x00000400  -> RP
#define FILE_ATTRIBUTE_COMPRESSED                          0x00000800  -> C
#define FILE_ATTRIBUTE_OFFLINE                                    0x00001000  -> O
#define FILE_ATTRIBUTE_NOT_CONTENT_INDEXED  0x00002000  -> NCI
#define FILE_ATTRIBUTE_ENCRYPTED                             0x00004000  -> E
#define FILE_ATTRIBUTE_VIRTUAL                                   0x00010000  -> V

So ANCI means “Archive, Not content Indexed” file create.

Advertisements
This entry was posted in Tools and tagged , . Bookmark the permalink.

One Response to Decode “Attributes/FileAttributes” value in ProcMon output

  1. Pingback: SP2013 - Crawler is unable to crawl some file share directories. - Blog On Search - Site Home - MSDN Blogs

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s