The layout of an attribute is
offset(length) Description 0(4) Type 4(4) Length 8(1) 0=resident, 1=data stored in runs 9(1) name length A(1) offset to data. Might be at 0x20 as well C(1) 1=compressed Resident attributes: 10(2?) data length Nonresident attributes: 10(8) starting VCN of this segment 20(2) offset to data 18(8) last VCN of this segment 28(8) size of the attribute 30(8) allocated disk space 38(8) length of initialized data All: data start Name (if present) data start + namelen start of data or data runsThe following attribute types are known. The list of attributes of a volume is stored in the $Attribute file.
For nonresident attributes, the data is stored in runs.