Nonresident attributes are stored in intervals of clusters called runs. Each run is represented by its starting cluster and its length. The starting cluster of a run is coded as an offset to the starting cluster of the previous run. Length and starting cluster are variable size fields. The first byte of a run indicates the size of both. The size of the offset is stored in the high nibble, and the size of the length in the high nibble.
Example: 21 20 ED 5 22 48 7 48 22 21 28 C8 DB First run: 20 clusters starting from 5ED (5ED to 60D) 2nd run: 748 clusters starting from 5ED+2248 (2835 to 2F7D) 3rd run: 28 clusters starting from 2835+DBC8 (3FD to 425)Note that the offset is interpreted as signed value.
How are sparse and compressed files stored