Skip main navigation

New offer! Get 30% off one whole year of Unlimited learning. Subscribe for just £249.99 £174.99. New subscribers only. T&Cs apply

Find out more

Attribute 0x40 $OBJECT_ID

Article detailing an overview of NT File System $MFT file segment entry (record) attribute 0x40 $OBJECT_ID.
© PA Knowledge Ltd | 7Safe Training
Attribute 0x40 $OBJECT_ID

The purpose of the Object Id attribute is to identify individual files on a network.

This attribute is known as a resident attribute meaning that all the relevant file information only resides within the attribute itself.

An example of an Object ID attribute is detailed below:

Screenshot of $MFT file segment entry attribute 0x40.

This attribute contains a 128 bit identifier which is used to uniquely identify a file on a Windows computer and within a Windows network. Note that a service called Distributed Linked Tracking (DLT) will first need to be enabled (on the Domain Controller or DC) before the tracking of files can occur across a network. DLT information is stored within the Active Directory (AD) database on the Domain Controller.

Additional information…

The DLT client on a Windows computer is enabled by default. To see the service running open up Task Manager and navigate to Services. The service is called ‘TrkWks’ (trkwks.dll) and will be run under a generic windows process (svchost.exe). See image below:

Screenshot of Task Manager displaying the status of services.

The 128 bit identifier if expressed as a value is 2128. The actual value is 340,282,366,920,938,463,463,374,607,431,768,211,456 which is a lot!

That number can be expressed as 340 billion, billion, billion, billion or 340 undecillion. An undecillian contains 36 zero’s!

Interestingly 2128 is the same value calculated by the MD5 algorithm.

© PA Knowledge Ltd | 7Safe Training
This article is from the free online

Introduction to Digital Forensics: Malware Analysis and Investigations

Created by
FutureLearn - Learning For Life

Reach your personal and professional goals

Unlock access to hundreds of expert online courses and degrees from top universities and educators to gain accredited qualifications and professional CV-building certificates.

Join over 18 million learners to launch, switch or build upon your career, all at your own pace, across a wide range of topic areas.

Start Learning now