2.2 WIN32_STREAM_ID

The WIN32_STREAM_ID structure is a header that precedes each backup stream in the NT backup file. This header identifies the type of backup stream, its size, and other attributes. The structure is as follows.


0


1


2


3


4


5


6


7


8


9

1
0


1


2


3


4


5


6


7


8


9

2
0


1


2


3


4


5


6


7


8


9

3
0


1

dwStreamId

dwStreamAttributes

Size

...

dwStreamNameSize

cStreamName (variable)

...

dwStreamId (4 bytes):  A 32-bit, unsigned integer that indicates the type of data in this backup stream. The value of this field MUST be one of the following.

Value

Meaning

ALTERNATE_DATA

0x00000004

Alternative data streams.

DATA

0x00000001

Standard data.

EA_DATA

0x00000002

Extended attribute data.

LINK

0x00000005

Hard link information.

OBJECT_ID

0x00000007

 Object identifiers.

REPARSE_DATA

0x00000008

Reparse points.

SECURITY_DATA

0x00000003

 Security descriptor data.

SPARSE_BLOCK

0x00000009

Data in a sparse file.

TXFS_DATA

0x0000000A

Transactional file system.

GHOSTED_FILE_EXTENTS

0x0000000B

Ghosted Extents.

dwStreamAttributes (4 bytes):  A 32-bit, unsigned long integer that indicates properties of the backup stream. The value of this field MUST be the bitwise OR of zero or more of the following. Other bits are unused and MUST be 0 and ignored on receipt.

Value

Meaning

STREAM_NORMAL_ATTRIBUTE

0x00000000

This backup stream has no special attributes.

STREAM_CONTAINS_SECURITY

0x00000002

The backup stream contains security information. This attribute applies only to backup stream of type SECURITY_DATA.

STREAM_SPARSE_ATTRIBUTE

0x00000008

The backup stream is part of a sparse file stream. This attribute applies only to backup stream of type DATA, ALTERNATE_DATA, and SPARSE_BLOCK.

STREAM_CONTAINS_GHOSTED_FILE_EXTENTS

0x00000010

The backup stream contains ghosted extents. This attribute applies only to backup stream of type DATA.

Size (8 bytes):  A 64-bit, unsigned integer that specifies the length of the data portion of the backup stream; this length MUST NOT include the length of the header. The next backup stream within the NT backup file, if any, MUST start at Size + dwStreamNameSize bytes beyond the end of this WIN32_STREAM_ID structure. Note that the alternate stream name, whose size is dwStreamNameSize bytes, is part of the header for the purposes of calculating the position of the next WIN32_STREAM_ID structure.

dwStreamNameSize (4 bytes):  A 32-bit, unsigned integer that specifies the length of the alternate stream name, in bytes. The value of this field MUST be 0 for all dwStreamId values other than ALTERNATE_DATA. For StreamID ALTERNATE_DATA, the value of this field MUST be in the range 0–65536, and it MUST be an integral multiple of two.

cStreamName (variable):  A Unicode string that specifies the name of the alternate stream. This string MUST NOT be null-terminated.

Size bytes of data MUST follow the header. The meaning of the data depends on the dwStreamId value and is specified in the following sections.