Using xattrs, one can access Windows extended attributes using the following command

getfattr -h -n system.ntfs_ea Ntfs_Mount_Point/some_file

The problem is instead of an attribute list, it returns a raw single binary value encoded as base64 or hex containing all the underlying attributes. For example


I know how to get a parsed result using ntfsinfo, but it requires the volume to be unmounted and I m looking for a file copy based on xattr data which means I need the volume to be mounted.

So for example (since I know the attitude name I m needing), how to get the value of $LXATTRB from Ntfs_Mount_Point/some_file?

1 Answer 1


It would be useful if you included the output it gives.

But in the meantime, maybe this code will help you out.

Perhaps this function specifically:

line 46: def print_getfattr


Okay, after your edit, best I could find is a nudge in the right direction:

This page contains the example you supplied, and another one with some more EA records.

and in this page, you can see it parsed, all the way in the bottom. I'm not sure it is parsed "enough", as I could not find out what file mode "a4 11 00 00" is. But as you can see it comes directly after the attribute name, which is in ascii (separated with a null byte). The EA's length is also there, I think, 0x04 in all of these specifically here. not sure about the 0x06 though.


Seems to be the case with multiple other extended records as well.


This mentions EA Tools, which may also come in handy, and also gives references to msdn in "Technical details"

Maybe try comparing the output from ntfsinfo to the hex dump shown, see if anything pops out.

Good luck in your NTFS journey.

  • Wrong answer! From a Linux side, all Windows extended attributes are stored in the $EA extended attributes. getfattr only allows to get $EA containing all attributes and the question is how to parse it. Commented May 1, 2022 at 13:40
  • I see. Can you give an example of the $EA "blob" you get? the code I linked also contains parsing, inside the function.
    – Yarin_007
    Commented May 1, 2022 at 13:41
  • I m not interested in manual parsing, but in automatic parsing as I ve 2 millions files to update from $LXATTRB. Even then, the format is more difficult to understand as some values are bytes or 16 bits aligned. What gave in tooling is using the Windows api, which can t be used to write $EA Commented May 4, 2022 at 18:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .