Decoding the FileAttributes field in ProcessMonitor

Random tip: if you’re using procmon.exe to monitor file system activity, you’ll see a FileAttributes field with a bunch of letters.  It’s not immediately obvious which letters correspond to which Win32 file attribute constants.  I asked around internally, and got the answer.  Blogging it here for general reference (and yes, the team does plan to…

0