A note on the Notes: >The maximum size of an internal $Data attribute varies depending on the size of other attributes stored in the MFT record. Most sources g

A note on the Notes: >The maximum size of an internal $Data attribute varies depending on the size of other attributes stored in the MFT record. Most sources give a maximum internal $Data attribute size of 600 to 700 bytes. Microsoft reports a 900 byte limit. As often happens both "most sources" and Microsoft are vague or inaccurate. Since the paper is about experiments, it is (to me) perplexing that the Authors did not actually try (and did not consider that on 512 bytes sector device the $MFT entry is 1024 bytes whilst on 4096 bytes sector device the $MFT entry is 4096). The actual numbers (only for the record) were determined experimentally): https://www.forensicfocus.com/forums/general/mft-resident-data/ https://www.forensicfocus.com/forums/general/mft-resident-da... and are influenced by the length of the filename and on the method used to create/write the file, but while still approximated, the maximum for a filename with max three characters is respectively 744 and 3784 bytes (3776 for a 8 character filename).