Question

i know that if 1 is present at the 4th position of binary representation of attribute then this is a directory, but i am not sure if 1 is not present at that location should i consider it as a file?

or is there any other attribute present to determine folder or file ?
please help me.

Thanks.

Answer 1

Every file has a File Record in Master File Table (MFT) of the volume.

You can check the 2-byte flag stored at 0x16 and 0x17(attention, little endian). The second bit (counting from right) tells whether it’s a folder(1), or a file(0).

if (flag & 0x02)
    it's a folder
else
    it's a file

If you change this bit that would originally represent a file to 1 by force, for example with the help of WinHex, and (probably a restart or system cache fresh is needed) double click it, OS would report that the file is corrupted.

In addition, the first bit tells if it is deleted.

if (flag & 0x01)
    it's a normal file or folder not deleted
else
    it's a deleted file or folder