Windows File Attributes Decoded: Understanding ‘A’, ‘C’, and Combination Flags in File Systems


2 views

When working with Windows Server 2003 file systems (and still relevant in modern Windows versions), you'll encounter single-letter flags in file attributes. These metadata markers control fundamental file behaviors that every developer should understand when writing file-handling code.

// Common attribute constants from Win32 API
#define FILE_ATTRIBUTE_READONLY     0x1
#define FILE_ATTRIBUTE_HIDDEN       0x2
#define FILE_ATTRIBUTE_SYSTEM       0x4
#define FILE_ATTRIBUTE_ARCHIVE      (A) 0x20
#define FILE_ATTRIBUTE_COMPRESSED   (C) 0x800

The letters represent:

  • A - Archive: Marks files modified since last backup (trigger for incremental backups)
  • C - Compressed: NTFS compression is enabled for the file
  • Combinations like AC indicate both flags are set

Checking attributes programmatically in C++:

DWORD GetFileAttribs(LPCTSTR filename) {
    DWORD attrs = GetFileAttributes(filename);
    if (attrs == INVALID_FILE_ATTRIBUTES) {
        // Error handling
        return 0;
    }
    
    if (attrs & FILE_ATTRIBUTE_ARCHIVE) {
        std::cout << "Archive flag set (A)\n";
    }
    
    if (attrs & FILE_ATTRIBUTE_COMPRESSED) {
        std::cout << "Compressed flag set (C)\n";
    }
    
    return attrs;
}

For quick checks in modern environments:

Get-ChildItem | Select-Object Name, Attributes
# or for specific flags:
(Get-Item file.txt).Attributes -band [System.IO.FileAttributes]::Archive

These attributes affect:

  • Backup/version control systems behavior
  • File transfer operations
  • Storage optimization strategies
  • Forensic analysis tools

Using Windows API:

BOOL success = SetFileAttributes(
    L"C:\\data\\report.txt",
    FILE_ATTRIBUTE_ARCHIVE | FILE_ATTRIBUTE_READONLY
);

Remember that some attributes require administrative privileges to modify, and compression attributes can only be set on NTFS volumes.


When examining files in Windows Explorer's details view, you'll notice various single-letter codes in the "Attributes" column. These represent the file's attribute flags, which control system behavior and metadata status. The most common flags you'll encounter are:

  • A - Archive (0x20 in hexadecimal)
  • C - Compressed (0x800)
  • H - Hidden (0x2)
  • R - Read-only (0x1)
  • S - System (0x4)

The 'A' (Archive) flag indicates the file has been modified since the last backup operation. Backup utilities typically clear this flag after processing. The 'C' (Compressed) flag means the file is stored using NTFS compression to save disk space.

When you see combinations like "AC", it means both attributes are active. This commonly occurs when a compressed file has been recently modified.

Here's how to check and modify these attributes programmatically using C#:

using System;
using System.IO;

class FileAttributesDemo {
    static void Main() {
        string filePath = @"C:\example.txt";
        
        // Get current attributes
        FileAttributes attributes = File.GetAttributes(filePath);
        Console.WriteLine("Current attributes: " + attributes);
        
        // Check for Archive flag
        bool isArchive = (attributes & FileAttributes.Archive) != 0;
        Console.WriteLine("Archive flag set: " + isArchive);
        
        // Check for Compressed flag
        bool isCompressed = (attributes & FileAttributes.Compressed) != 0;
        Console.WriteLine("Compressed flag set: " + isCompressed);
        
        // Set Archive flag
        File.SetAttributes(filePath, attributes | FileAttributes.Archive);
        
        // Clear Archive flag
        File.SetAttributes(filePath, attributes & ~FileAttributes.Archive);
    }
}

For Windows Server administration, PowerShell provides more flexible handling:

# Get file attributes
Get-ItemProperty -Path "C:\example.txt" | Select-Object -ExpandProperty Attributes

# Set Archive attribute
Set-ItemProperty -Path "C:\example.txt" -Name Attributes -Value "Archive"

# Add Compressed attribute (requires administrative privileges)
compact /c "C:\example.txt"

When working with file operations:

  • Backup software relies on the Archive flag to determine changed files
  • Compressed files (C flag) may have performance implications for I/O operations
  • Attribute changes require proper file system permissions
  • Some attributes are mutually exclusive (e.g., Compressed and Encrypted)

For low-level control, you can use the Windows API:

#include <windows.h>

DWORD GetFileAttributes(LPCTSTR lpFileName);
BOOL SetFileAttributes(LPCTSTR lpFileName, DWORD dwFileAttributes);

The complete attribute flags are defined in winnt.h as FILE_ATTRIBUTE_* constants.