Glossary
Open attribute table
The NTFS log's table of attributes currently open for logging; records refer to their target attribute by an index into it.
NTFS log records do not name the attribute they change directly. They carry a target attribute index that points into the open attribute table, whose entries give the file reference and attribute type (for example $MFT:$DATA or a directory's $INDEX_ALLOCATION). Names of named attributes are kept in a separate attribute names list.
The table is built from OpenNonresidentAttribute records and written in full at each checkpoint as OpenAttributeTableDump and AttributeNamesDump records. A parser needs it to tell which file and attribute a record touches. Entry layouts differ between NTFS client versions, one of the places where $LogFile parsers can disagree. More in redo/undo operations explained.