Hey again. Seems like that: https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/ns-wdm-_file_full_ea_information is the format used per single(!) EA as given from system.ntfs_ea (with some NUL terminators after the name an value which seem to not be counted in the length fields). Guess that might be more or less the format that’s also used on disk? Thanks, Philippe
