Lines Matching +full:attribute +full:- +full:set
1 /* SPDX-License-Identifier: GPL-2.0-or-later */
3 * layout.h - All NTFS associated on-disk structures. Part of the Linux-NTFS
6 * Copyright (c) 2001-2005 Anton Altaparmakov
71 approx. 4.7x10^21 bytes. (-; */
117 * operator! (-8
163 * been written to disk. The values 0 and -1 (ie. 0xffff) are not used. All
165 * are set to it (during writing). If they are not, an incomplete multi sector
170 * (obviously) finish before the last le16 of the first 512-byte sector.
175 NTFS_RECORD_TYPE magic; /* A four-byte magic identifying the record
187 * in the bitmap attribute of the mft; presumably in order to avoid accidental
193 FILE_MFT = 0, /* Master file table (mft). Data attribute
194 contains the entries and bitmap attribute
197 in data attribute. If cluster size > 4kiB,
200 FILE_LogFile = 2, /* Journalling log in data attribute. */
201 FILE_Volume = 3, /* Volume name attribute and volume information
202 attribute (flags and ntfs version). Windows
205 FILE_AttrDef = 4, /* Array of attribute definitions in data
206 attribute. */
209 data attribute. */
211 attribute. */
212 FILE_BadClus = 8, /* Contains all bad clusters in the non-resident
213 data attribute. */
214 FILE_Secure = 9, /* Shared security descriptors in data attribute
219 characters in data attribute. */
223 FILE_reserved12 = 12, /* Reserved for future use (records 12-15). */
232 * These are the so far known MFT_RECORD_* flags (16-bit) which contain
246 * A reference consists of a 48-bit index into the mft and a 16-bit sequence
249 * For error reporting purposes we treat the 48-bit index as a signed quantity.
259 * FIXME: Since inodes are 32-bit as of now, the driver needs to always check
262 * to become HUGE in order to need more than 32-bits worth of mft records.
264 * the non-resident attributes, etc.) would require 4Tb of space on their own
267 * horrible thing to do as it would trash our current driver implementation. )-:
268 * Do I hear screams "we want 64-bit inodes!" ?!? (-;
280 * Typedef the MFT_REF as a 64-bit value for easier handling.
307 * This is followed by a sequence of variable length attribute records which
308 * is terminated by an attribute of type AT_END which is a truncated attribute
309 * in that it only consists of the attribute type code AT_END and none of the
310 * other members of the attribute structure are present.
314 /* 0 NTFS_RECORD; -- Unfolded here as gcc doesn't like unnamed structs. */
336 /* 20*/ le16 attrs_offset; /* Byte offset to the first attribute in this
338 NOTE: Must be aligned to 8-byte boundary. */
341 set to zero. */
343 NOTE: Must be aligned to 8-byte boundary. */
351 locate the attribute list attribute present
356 attribute list also means finding the other
357 potential extents, belonging to the non-base
360 the next attribute added to this mft record.
363 this number is set to zero. NOTE: The first
383 /* 0 NTFS_RECORD; -- Unfolded here as gcc doesn't like unnamed structs. */
405 /* 20*/ le16 attrs_offset; /* Byte offset to the first attribute in this
407 NOTE: Must be aligned to 8-byte boundary. */
410 set to zero. */
412 NOTE: Must be aligned to 8-byte boundary. */
420 locate the attribute list attribute present
425 attribute list also means finding the other
426 potential extents, belonging to the non-base
429 the next attribute added to this mft record.
432 this number is set to zero. NOTE: The first
447 * System defined attributes (32-bit). Each attribute type has a corresponding
448 * attribute name (Unicode string of maximum 64 character length) as described
449 * by the attribute definitions present in the data attribute of the $AttrDef
452 * a revealing choice of symbol I do not know what is... (-;
479 * The collation rules for sorting views/indexes/etc (32-bit).
481 * COLLATION_BINARY - Collate by binary compare where the first byte is most
483 * COLLATION_UNICODE_STRING - Collate Unicode strings by comparing their binary
486 * COLLATION_FILE_NAME - Collate file names as Unicode strings. The collation
493 * COLLATION_NTOFS_ULONG - Sorting is done according to ascending le32 key
496 * COLLATION_NTOFS_SID - Sorting is done according to ascending SID values.
498 * COLLATION_NTOFS_SECURITY_HASH - Sorting is done first by ascending hash
501 * COLLATION_NTOFS_ULONGS - Sorting is done according to a sequence of ascending
503 * sorts by object_id (16-byte), by splitting up the object_id in four
529 * The flags (32-bit) describing attribute properties in the attribute
533 * name attribute has this flag set and this is the only attribute indexed in
537 ATTR_DEF_INDEXABLE = cpu_to_le32(0x02), /* Attribute can be
539 ATTR_DEF_MULTIPLE = cpu_to_le32(0x04), /* Attribute type
542 ATTR_DEF_NOT_ZERO = cpu_to_le32(0x08), /* Attribute value
543 must contain at least one non-zero
545 ATTR_DEF_INDEXED_UNIQUE = cpu_to_le32(0x10), /* Attribute must be
546 indexed and the attribute value must be
547 unique for the attribute type in all of
549 ATTR_DEF_NAMED_UNIQUE = cpu_to_le32(0x20), /* Attribute must be
551 the attribute type in all of the mft
553 ATTR_DEF_RESIDENT = cpu_to_le32(0x40), /* Attribute must be
556 modifications to this attribute,
558 non-resident. Without this, only log
559 modifications if the attribute is
566 * The data attribute of FILE_AttrDef contains a sequence of attribute
570 * Entries are sorted by attribute type. The flags describe whether the
571 * attribute can be resident/non-resident and possibly other things, but the
576 /* 0*/ ntfschar name[0x40]; /* Unicode name of the attribute. Zero
578 /* 80*/ ATTR_TYPE type; /* Type of the attribute. */
582 /* 8c*/ ATTR_DEF_FLAGS flags; /* Flags describing the attribute. */
583 /* 90*/ sle64 min_size; /* Optional minimum attribute size. */
584 /* 98*/ sle64 max_size; /* Maximum size of attribute. */
589 * Attribute flags (16-bit).
603 * Attribute compression.
605 * Only the data attribute is ever compressed in the current ntfs driver in
606 * Windows. Further, compression is only applied when the data attribute is
607 * non-resident. Finally, to use compression, the maximum allowed cluster size
612 * non-resident attribute record header (more precisely: X = 2^compression_unit
620 * entry has length = X and lcn = -1. The mapping pairs array actually
622 * all, which is then interpreted by the driver as lcn = -1.
642 * immediately followed by a sparse entry with length = X - L and
643 * lcn = -1. The latter entry is to make up the vcn counting to the
651 * L - X. Another example: if length L < X, this does not necessarily mean that
655 * following runlist entry describes at least X - L sparse clusters, thus
661 * NOTE: At the end of the compressed attribute value, there most likely is not
670 * Flags of resident attributes (8-bit).
673 RESIDENT_ATTR_IS_INDEXED = 0x01, /* Attribute is referenced in an index
675 modifying the attribute). */
681 * Attribute record header. Always aligned to 8-byte boundary.
685 /* 0*/ ATTR_TYPE type; /* The (32-bit) type of the attribute. */
687 attribute (aligned to 8-byte boundary).
688 Used to get to the next attribute. */
689 /* 8*/ u8 non_resident; /* If 0, attribute is resident.
690 If 1, attribute is non-resident. */
691 /* 9*/ u8 name_length; /* Unicode character size of name of attribute.
694 beginning of the name from the attribute
698 follow with attribute value or mapping pairs
699 array, resident and non-resident attributes
700 respectively, aligning to an 8-byte
702 /* 12*/ ATTR_FLAGS flags; /* Flags describing the attribute. */
703 /* 14*/ le16 instance; /* The instance of this attribute record. This
710 /* 16 */ le32 value_length;/* Byte size of attribute value. */
711 /* 20 */ le16 value_offset;/* Byte offset of the attribute
713 attribute record. When creating,
714 align to 8-byte boundary if we
717 of 8-bytes. */
719 /* 23 */ s8 reserved; /* Reserved/alignment to 8-byte
722 /* Non-resident attributes. */
725 for this portion of the attribute value or
727 case). - Only when an attribute list is used
730 the attribute value. - Usually there is only one
731 portion, so this usually equals the attribute
732 value size in clusters minus 1. Can be -1 for
740 record header aligned to 8-byte boundary. */
747 Sparse files have this set to 0 on XPSP2. */
748 /* 35*/ u8 reserved[5]; /* Align to 8-byte boundary. */
750 be difficult to keep them up-to-date.*/
752 allocated to hold the attribute value. Always
759 /* 48*/ sle64 data_size; /* Byte size of the attribute
761 attribute value is compressed or sparse. */
763 portion of the attribute value. Usually equals
766 /* 64*/ sle64 compressed_size; /* Byte size of the attribute
779 * File attribute flags (32-bit) appearing in the file_attributes fields of the
780 * STANDARD_INFORMATION attribute of MFT_RECORDs and the FILENAME_ATTR
784 * appear in the STANDARD_INFORMATION attribute whilst only some others appear
785 * in the FILENAME_ATTR attribute of MFT_RECORDs. Unless otherwise stated the
822 * attribute of an mft record.
827 an index root attribute or not. */
839 * are the number of 100-nanosecond intervals since 1st January 1601, 00:00:00
841 * 00:00:00 UTC and is stored as the number of 1-second intervals since then.)
845 * Attribute: Standard information (0x10).
858 /* 8*/ sle64 last_data_change_time; /* Time the data attribute was last
864 updated on read-only volumes). In
874 /* 36*/ u8 reserved12[12]; /* Reserved/alignment to 8-byte
883 * Recognize the difference by comparing the length of the resident attribute
887 * Assume NTFS 1.2- format.
889 * Upgrade attribute to NTFS 3.x format.
891 * Use NTFS 1.2- format for access.
894 * Only problem is that it might be legal to set the length of the value to
895 * arbitrarily large values thus spoiling this check. - But chkdsk probably
902 Set to zero if maximum_versions is zero. */
927 * Attribute: Attribute list (0x20).
929 * - Can be either resident or non-resident.
930 * - Value consists of a sequence of variable length, 8-byte aligned,
932 * - The list is not terminated by anything at all! The only way to know when
934 * the attribute value size.
935 * - The attribute list attribute contains one entry for each attribute of
936 * the file in which the list is located, except for the list attribute
937 * itself. The list is sorted: first by attribute type, second by attribute
939 * non-resident attribute (if present) immediately follow after the initial
940 * extent. They are ordered by lowest_vcn and have their instace set to zero.
942 * - Further restrictions:
943 * - If not resident, the vcn to lcn mapping array has to fit inside the
945 * - The attribute list attribute value has a maximum size of 256kb. This
947 * - Attribute lists are only used when the attributes of mft record do not
949 * non-resident) having been made non-resident. This can happen e.g. when:
950 * - File has a large number of hard links (lots of file name
952 * - The mapping pairs array of some non-resident attribute becomes so
954 * - The security descriptor is very complex (not applicable to
956 * - There are many named streams.
960 /* 0*/ ATTR_TYPE type; /* Type of referenced attribute. */
961 /* 4*/ le16 length; /* Byte size of this entry (8-byte aligned). */
963 attribute or 0 if unnamed. */
964 /* 7*/ u8 name_offset; /* Byte offset to beginning of attribute name
965 (always set this to where the name would
968 of the attribute value. This is usually 0. It
969 is non-zero for the case where one attribute
972 this attribute. In the latter case, each mft
973 record holds one extent of the attribute and
974 there is one attribute list entry for each
981 attribute value. */
983 attribute being referenced; otherwise 0. */
996 * Possible namespaces for filenames in ntfs (8-bit).
1009 '\0' and '/' and in particular the following set of characters is
1018 /* The standard DOS filenames (8.3 format). Uppercase only. All 8-bit
1029 * Attribute: Filename (0x30).
1035 * information attribute.
1046 /* 10*/ sle64 last_data_change_time; /* Time the data attribute was last
1052 /* 28*/ sle64 allocated_size; /* Byte size of on-disk allocated space
1053 for the unnamed data attribute. So
1056 $DATA attribute and for compressed
1059 $DATA attribute. For a directory or
1061 attribute, this is always 0. NOTE:
1065 data attribute. For a directory or
1067 attribute, this is always 0. */
1091 * 128-bit value consisting of one group of eight hexadecimal digits, followed
1096 * 1F010768-5A73-BC91-0010A52216A7
1112 * birth_volume_id - object_id of FILE_Volume on which the file was first
1114 * birth_object_id - object_id of file when it was first created. Usually
1116 * domain_id - Reserved (always zero).
1132 * Attribute: Object id (NTFS 3.0+) (0x40).
1139 /* The following fields are optional. The attribute value size is 16
1156 * The pre-defined IDENTIFIER_AUTHORITIES used as SID_IDENTIFIER_AUTHORITY in
1160 // SECURITY_NULL_SID_AUTHORITY = {0, 0, 0, 0, 0, 0}, /* S-1-0 */
1161 // SECURITY_WORLD_SID_AUTHORITY = {0, 0, 0, 0, 0, 1}, /* S-1-1 */
1162 // SECURITY_LOCAL_SID_AUTHORITY = {0, 0, 0, 0, 0, 2}, /* S-1-2 */
1163 // SECURITY_CREATOR_SID_AUTHORITY = {0, 0, 0, 0, 0, 3}, /* S-1-3 */
1164 // SECURITY_NON_UNIQUE_AUTHORITY = {0, 0, 0, 0, 0, 4}, /* S-1-4 */
1165 // SECURITY_NT_SID_AUTHORITY = {0, 0, 0, 0, 0, 5}, /* S-1-5 */
1170 * authorities to make up universal well-known SIDs.
1174 * For example, the universal well-known SID Creator Owner ID (S-1-3-0) is
1179 SECURITY_NULL_RID = 0, /* S-1-0 */
1180 SECURITY_WORLD_RID = 0, /* S-1-1 */
1181 SECURITY_LOCAL_RID = 0, /* S-1-2 */
1183 SECURITY_CREATOR_OWNER_RID = 0, /* S-1-3 */
1184 SECURITY_CREATOR_GROUP_RID = 1, /* S-1-3 */
1186 SECURITY_CREATOR_OWNER_SERVER_RID = 2, /* S-1-3 */
1187 SECURITY_CREATOR_GROUP_SERVER_RID = 3, /* S-1-3 */
1213 * Well-known domain relative sub-authority values (RIDs).
1249 * The universal well-known SIDs:
1251 * NULL_SID S-1-0-0
1252 * WORLD_SID S-1-1-0
1253 * LOCAL_SID S-1-2-0
1254 * CREATOR_OWNER_SID S-1-3-0
1255 * CREATOR_GROUP_SID S-1-3-1
1256 * CREATOR_OWNER_SERVER_SID S-1-3-2
1257 * CREATOR_GROUP_SERVER_SID S-1-3-3
1259 * (Non-unique IDs) S-1-4
1261 * NT well-known SIDs:
1263 * NT_AUTHORITY_SID S-1-5
1264 * DIALUP_SID S-1-5-1
1266 * NETWORD_SID S-1-5-2
1267 * BATCH_SID S-1-5-3
1268 * INTERACTIVE_SID S-1-5-4
1269 * SERVICE_SID S-1-5-6
1270 * ANONYMOUS_LOGON_SID S-1-5-7 (aka null logon session)
1271 * PROXY_SID S-1-5-8
1272 * SERVER_LOGON_SID S-1-5-9 (aka domain controller account)
1273 * SELF_SID S-1-5-10 (self RID)
1274 * AUTHENTICATED_USER_SID S-1-5-11
1275 * RESTRICTED_CODE_SID S-1-5-12 (running restricted code)
1276 * TERMINAL_SERVER_SID S-1-5-13 (running on terminal server)
1278 * (Logon IDs) S-1-5-5-X-Y
1280 * (NT non-unique IDs) S-1-5-0x15-...
1282 * (Built-in domain) S-1-5-0x20
1286 * The SID_IDENTIFIER_AUTHORITY is a 48-bit value used in the SID structure.
1293 u16 high_part; /* High 16-bits. */
1294 u32 low_part; /* Low 32-bits. */
1300 * The SID structure is a variable-length structure used to uniquely identify
1304 * S-R-I-S-S...
1306 * - The first "S" is the literal character 'S' identifying the following
1308 * - R is the revision level of the SID expressed as a sequence of digits
1310 * - I is the 48-bit identifier_authority, expressed as digits as R above.
1311 * - S... is one or more sub_authority values, expressed as digits as above.
1313 * Example SID; the domain-relative SID of the local Administrators group on
1315 * S-1-5-32-544
1341 * The predefined ACE types (8-bit, see below).
1371 * The ACE flags (8-bit) for audit and inheritance (see below).
1397 * An ACE is an access-control entry in an access-control list (ACL).
1399 * the types of access that generate system-administration messages or alarms
1403 * Each ACE starts with an ACE_HEADER structure (aligned on 4-byte boundary),
1415 * The access mask (32-bit). Defines the access rights.
1451 * children), even if the files are read-only. (DIRECTORY)
1568 /* 0 ACE_HEADER; -- Unfolded here as gcc doesn't like unnamed structs. */
1579 * The object ACE flags (32-bit).
1589 /* 0 ACE_HEADER; -- Unfolded here as gcc doesn't like unnamed structs. */
1606 * An ACL is an access-control list (ACL).
1610 * are aligned on 4-byte boundaries.
1640 * The security descriptor control flags (16-bit).
1642 * SE_OWNER_DEFAULTED - This boolean flag, when set, indicates that the SID
1648 * SE_GROUP_DEFAULTED - This boolean flag, when set, indicates that the SID in
1654 * SE_DACL_PRESENT - This boolean flag, when set, indicates that the security
1655 * descriptor contains a discretionary ACL. If this flag is set and the
1659 * SE_DACL_DEFAULTED - This boolean flag, when set, indicates that the ACL
1664 * DaclPresent flag is not set.
1666 * SE_SACL_PRESENT - This boolean flag, when set, indicates that the security
1668 * flag is set and the Sacl field of the SECURITY_DESCRIPTOR is null, then
1671 * SE_SACL_DEFAULTED - This boolean flag, when set, indicates that the ACL
1676 * SaclPresent flag is not set.
1678 * SE_SELF_RELATIVE - This boolean flag, when set, indicates that the security
1679 * descriptor is in self-relative form. In this form, all fields of the
1706 * Self-relative security descriptor. Contains the owner and group SIDs as well
1721 SE_SACL_PRESENT is set in the control field. If
1722 SE_SACL_PRESENT is set but sacl is NULL, a NULL ACL
1725 SE_DACL_PRESENT is set in the control field. If
1726 SE_DACL_PRESENT is set but dacl is NULL, a NULL ACL
1736 * descriptors. On disk, a self-relative security descriptor is used.
1750 SE_SACL_PRESENT is set in the control field. If
1751 SE_SACL_PRESENT is set but sacl is NULL, a NULL ACL
1754 SE_DACL_PRESENT is set in the control field. If
1755 SE_DACL_PRESENT is set but dacl is NULL, a NULL ACL
1768 the same as pointers, at least on ia32 architecture are 32-bit. */
1773 * Attribute: Security descriptor (0x50). A standard self-relative security
1776 * NOTE: Can be resident or non-resident.
1779 * from the standard information attribute.
1787 * FILE_Secure contains no unnamed data attribute, i.e. it has zero length. It
1795 * data attribute. The $SII index is sorted by ascending security_id.
1799 * the security descriptor's storage location within the $SDS data attribute.
1807 * descriptor in the $SDS attribute is read from the found $SDH index entry and
1808 * is stored in the $STANDARD_INFORMATION attribute of the file/directory to
1810 * attribute is present in all base mft records (i.e. in all files and
1814 * security_id and is added to the $SDS data attribute. Then, entries
1815 * referencing the this security descriptor in the $SDS data attribute are
1834 * The $SDS data stream contains the security descriptors, aligned on 16-byte
1846 /* 0 SECURITY_DESCRIPTOR_HEADER; -- Unfolded here as gcc doesn't like
1852 /* 20*/ SECURITY_DESCRIPTOR_RELATIVE sid; /* The self-relative security
1875 * Attribute: Volume name (0x60).
1885 * Possible flags for the volume (16-bit).
1901 /* To make our life easier when checking if we must mount read-only. */
1908 * Attribute: Volume information (0x70).
1923 * Attribute: Data attribute (0x80).
1925 * NOTE: Can be resident or non-resident.
1934 * Index header flags (8-bit).
1938 * When index header is in an index root attribute:
1941 root attribute and there is no index allocation
1942 attribute present. */
1944 attribute and/or an index allocation attribute is
1948 * allocation attribute:
1970 aligned to 8-byte boundary. */
1973 size, aligned to 8-byte boundary. */
1976 /* NOTE: For the index root attribute, the above two numbers are always
1977 equal, as the attribute is resident and it is resized as needed. In
1978 the case of the index allocation attribute the attribute is not
1980 equal the index_block_size specified by the INDEX_ROOT attribute
1981 corresponding to the INDEX_ALLOCATION attribute this INDEX_BLOCK
1984 u8 reserved[3]; /* Reserved/align to 8-byte boundary. */
1988 * Attribute: Index root (0x90).
1996 * is the only attribute describing the directory. When the directory is too
1998 * are present: an index allocation attribute, containing sub-nodes of the B+
1999 * directory tree (see below), and a bitmap attribute, describing which virtual
2000 * cluster numbers (vcns) in the index allocation attribute are in use by an
2007 ATTR_TYPE type; /* Type of the indexed attribute. Is
2015 the index allocation attribute). */
2017 the index allocation attribute), when
2024 u8 reserved[3]; /* Reserved/align to 8-byte boundary. */
2030 * Attribute: Index allocation (0xa0).
2032 * NOTE: Always non-resident (doesn't make sense to be resident anyway!).
2039 /* 0 NTFS_RECORD; -- Unfolded here as gcc doesn't like unnamed structs. */
2078 reparse point attribute. */
2082 * Quota flags (32-bit).
2118 * owner_id, is found in the standard information attribute. The collation rule
2137 sle64 threshold; /* Soft quota (-1 if not limited). */
2138 sle64 limit; /* Hard quota (-1 if not limited). */
2147 * Predefined owner_id values (32-bit).
2164 * Index entry flags (16-bit).
2168 sub-node, i.e. a reference to an index block in form of
2172 represent a file but it can point to a sub-node. */
2175 enum bit width to 16-bit. */
2185 struct { /* Only valid when INDEX_ENTRY_END is not set. */
2200 8-bytes. */
2203 multiple of 8-bytes. */
2205 /* 14*/ le16 reserved; /* Reserved/align to 8-byte boundary. */
2212 * an index root attribute or an index allocation attribute.
2218 /* 0 INDEX_ENTRY_HEADER; -- Unfolded here as gcc dislikes unnamed structs. */
2220 struct { /* Only valid when INDEX_ENTRY_END is not set. */
2235 8-bytes. */
2238 multiple of 8-bytes. */
2240 le16 reserved; /* Reserved/align to 8-byte boundary. */
2242 /* 16*/ union { /* The key of the indexed attribute. NOTE: Only present
2243 if INDEX_ENTRY_END bit in flags is not set. NOTE: On
2263 // leVCN vcn; /* If INDEX_ENTRY_NODE bit in flags is set, the last
2268 // of the non-resident index allocation attribute). If
2271 // key_length, the address of the 8-byte boundary
2273 // (char*)ie + le16_to_cpu(ie*)->length) - sizeof(VCN),
2278 * Attribute: Bitmap (0xb0).
2282 * When used in conjunction with the index allocation attribute, each bit
2283 * corresponds to one index block within the index allocation attribute. Thus
2285 * number of clusters in the index allocation attribute.
2295 * The reparse point tag is an unsigned 32-bit value divided in three parts:
2302 * bit 29: Name surrogate bit. If set, the filename is an alias for
2304 * bit 30: High-latency bit. If set, accessing the first byte of data will
2306 * bit 31: Microsoft bit. If set, the tag is owned by Microsoft. User
2335 * Attribute: Reparse point (0xc0).
2337 * NOTE: Can be resident or non-resident.
2342 le16 reserved; /* Align to 8-byte boundary. */
2347 * Attribute: Extended attribute (EA) information (0xd0).
2355 the NEED_EA bit set. */
2364 * Extended attribute flags (8-bit).
2367 NEED_EA = 0x80 /* If set the file to which the EA belongs
2375 * Attribute: Extended attribute (EA) (0xe0).
2377 * NOTE: Can be resident or non-resident.
2379 * Like the attribute list and the index buffer list, the EA attribute value is
2395 * Attribute: Property set (0xf0).
2397 * Intended to support Native Structure Storage (NSS) - a feature removed from
2405 * Attribute: Logged utility stream (0x100).
2407 * NOTE: Can be resident or non-resident.
2409 * Operations on this attribute are logged to the journal ($LogFile) like
2413 * attribute with the name $EFS.