Glossary
$FILE_NAME ($FN)
The NTFS attribute (type 0x30) holding a file's name, parent folder reference, sizes and a second set of four timestamps maintained by the file system.
$FILE_NAME ($FN, attribute type 0x30) stores a file's name, the MFT reference of its parent directory, allocated and real sizes, flags and four timestamps. A file can have several: a long name, a DOS 8.3 short name, or hard links. A copy of $FN is also stored in each directory index entry ($I30) that points to the file.
The file system sets $FN times mainly when a file is created, renamed or moved, and applications cannot set them directly, which makes them a useful reference against $STANDARD_INFORMATION. In $LogFile, $FN structures appear in FILE record images, attribute creations and index entry additions and deletions — which is how names reach the log. See recovering deleted-file evidence.