Reading OpusMetaInformation powershell

If you're really determined, the [NTFS file-stream] format looks as follows:
Windows Terminal

Given a rating of "5 stars" and a tags of "touched"

afm .%H(fs-read('.default.md:\x07OpusMetaInformation'),,16)
1400000000000000
6300000000000000
0900000074006F00
7500630068006500
640000000000

The rating is at offset 16 => "63"

63~00000000000000~

The tags => "touched" is a UNICODE string whose UInt32 (DWORD) length starts at offset 32

09000000~7400~6F00~7500~6300~6800~6500~6400~0000~0000
length 9-chars, 0x74, 0x75, 0x63, 0x68, 0x65, 0x64, 0, 0

E.g.,

afm .(`$:%H('touched\x00\x00') length: $:sizeof('touched\x00\x00')`)
746F75636865640000 length: 9

You can see [xattr] file streams on an NTFS-File by typing dir /R at a console [wt.exe or cmd.exe] command-line.

1 Like