+ attr = (void*)( (char*)hdr + hdr->FirstAttribOfs );
+ i = 0;
+ while( (tVAddr)attr < (tVAddr)hdr + hdr->RecordSize )
+ {
+ if(attr->Type == 0xFFFFFFFF) break;
+ Log_Debug("FS_NTFS", "- Attribute %i", i ++);
+ Log_Debug("FS_NTFS", " > Type = 0x%x", attr->Type);
+ Log_Debug("FS_NTFS", " > Size = 0x%x", attr->Size);
+ Log_Debug("FS_NTFS", " > ResidentFlag = 0x%x", attr->ResidentFlag);
+ Log_Debug("FS_NTFS", " > NameLength = %i", attr->NameLength);
+ Log_Debug("FS_NTFS", " > NameOffset = 0x%x", attr->NameOffset);
+ Log_Debug("FS_NTFS", " > Flags = 0x%x", attr->Flags);
+ Log_Debug("FS_NTFS", " > AttributeID = 0x%x", attr->AttributeID);
+ if( !attr->ResidentFlag ) {
+ Log_Debug("FS_NTFS", " > AttribLen = 0x%x", attr->Resident.AttribLen);
+ Log_Debug("FS_NTFS", " > AttribOfs = 0x%x", attr->Resident.AttribOfs);
+ Log_Debug("FS_NTFS", " > IndexedFlag = 0x%x", attr->Resident.IndexedFlag);
+ Log_Debug("FS_NTFS", " > Name = '%*C'", attr->NameLength, attr->Resident.Name);
+ Debug_HexDump("FS_NTFS",
+ (void*)( (tVAddr)attr + attr->Resident.AttribOfs ),
+ attr->Resident.AttribLen
+ );
+ }
+ else {
+ Log_Debug("FS_NTFS", " > StartingVCN = 0x%llx", attr->NonResident.StartingVCN);
+ Log_Debug("FS_NTFS", " > LastVCN = 0x%llx", attr->NonResident.LastVCN);
+ Log_Debug("FS_NTFS", " > DataRunOfs = 0x%x", attr->NonResident.DataRunOfs);
+ Log_Debug("FS_NTFS", " > CompressionUnitSize = 0x%x", attr->NonResident.CompressionUnitSize);
+ Log_Debug("FS_NTFS", " > AllocatedSize = 0x%llx", attr->NonResident.AllocatedSize);
+ Log_Debug("FS_NTFS", " > RealSize = 0x%llx", attr->NonResident.RealSize);
+ Log_Debug("FS_NTFS", " > InitiatedSize = 0x%llx", attr->NonResident.InitiatedSize);
+ Log_Debug("FS_NTFS", " > Name = '%*C'", attr->NameLength, attr->NonResident.Name);
+ }
+
+ attr = (void*)( (tVAddr)attr + attr->Size );
+ }
+