Skip main navigation

Attribute 0x40 $OBJECT_ID

Article detailing an overview of NT File System $MFT file segment entry (record) attribute 0x40 $OBJECT_ID.
© PA Knowledge Ltd | 7Safe Training

Attribute 0x40 $OBJECT_ID

The purpose of the Object Id attribute is to identify individual files on a network.

This attribute is known as a resident attribute meaning that all the relevant file information only resides within the attribute itself.

An example of an Object ID attribute is detailed below:

Screenshot of $MFT file segment entry attribute 0x40.

This attribute contains a 128 bit identifier which is used to uniquely identify a file on a Windows computer and within a Windows network. Note that a service called Distributed Linked Tracking (DLT) will first need to be enabled (on the Domain Controller or DC) before the tracking of files can occur across a network. DLT information is stored within the Active Directory (AD) database on the Domain Controller.

Additional information…

The DLT client on a Windows computer is enabled by default. To see the service running open up Task Manager and navigate to Services. The service is called ‘TrkWks’ (trkwks.dll) and will be run under a generic windows process (svchost.exe). See image below:

Screenshot of Task Manager displaying the status of services.

The 128 bit identifier if expressed as a value is 2128. The actual value is 340,282,366,920,938,463,463,374,607,431,768,211,456 which is a lot!

That number can be expressed as 340 billion, billion, billion, billion or 340 undecillion. An undecillian contains 36 zero’s!

Interestingly 2128 is the same value calculated by the MD5 algorithm.

© PA Knowledge Ltd | 7Safe Training
This article is from the free online

Introduction to Digital Forensics: Malware Analysis and Investigations

Created by
FutureLearn - Learning For Life

Our purpose is to transform access to education.

We offer a diverse selection of courses from leading universities and cultural institutions from around the world. These are delivered one step at a time, and are accessible on mobile, tablet and desktop, so you can fit learning around your life.

We believe learning should be an enjoyable, social experience, so our courses offer the opportunity to discuss what you’re learning with others as you go, helping you make fresh discoveries and form new ideas.
You can unlock new opportunities with unlimited access to hundreds of online short courses for a year by subscribing to our Unlimited package. Build your knowledge with top universities and organisations.

Learn more about how FutureLearn is transforming access to education