I have recently written a DEFLATE compressor and decompressor. As far as I understand the fstream Windows gives you does not include NTFS attributes as these are found in the $MFT. I need to go over NTFS again to make clear what is happening there. Windows right click context menu Zip seems to store NTFS file attributes. Am I wrong to think that the $MFT header, up until file data, is simply being copied into the Zip Archives Local File Header's 'Extra Field'? I say up to, because if I recall correctly, a file can be stored in an $MFT attribute.
I've tried going over the specifications and I looked for similar cases. No cases were found. I will be reading the Local File Headers and will be parsing the Extra Field to see if the information is stored there over the next week.
[EDIT]
I could call NtQueryInformationFile and ask for FileAllInformation and store the struct. I'd like to be able to read a Windows Zip with extended attributes though.
An NTFS extra field is documented in the PKWare appnote. If you can write your own deflate and inflate, you can write your own zipper and unzipper to generate and process the extra field.
4.5.5 -NTFS Extra Field (0x000a):
The following is the layout of the NTFS attributes
"extra" block. (Note: At this time the Mtime, Atime
and Ctime values MAY be used on any WIN32 system.)
Note: all fields stored in Intel low-byte/high-byte order.
Value Size Description
----- ---- -----------
(NTFS) 0x000a 2 bytes Tag for this "extra" block type
TSize 2 bytes Size of the total "extra" block
Reserved 4 bytes Reserved for future use
Tag1 2 bytes NTFS attribute tag value #1
Size1 2 bytes Size of attribute #1, in bytes
(var) Size1 Attribute #1 data
.
.
.
TagN 2 bytes NTFS attribute tag value #N
SizeN 2 bytes Size of attribute #N, in bytes
(var) SizeN Attribute #N data
For NTFS, values for Tag1 through TagN are as follows:
(currently only one set of attributes is defined for NTFS)
Tag Size Description
----- ---- -----------
0x0001 2 bytes Tag for attribute #1
Size1 2 bytes Size of attribute #1, in bytes
Mtime 8 bytes File last modification time
Atime 8 bytes File last access time
Ctime 8 bytes File creation time