Analysis and manipulation of extended attribute ($EA) on NTFS