Windows Explorer's file attribute column values

R = Read-Only: Most software, when seeing a file marked read-only, will refuse to delete or modify it. This is pretty straight-forward. For example, DOS will say "Access denied" if you try to delete a read-only file. On the other hand, Windows Explorer will happily munch it. Some will choose the middle ground: they will let you modify or delete the file, but only after asking for confirmation.

H = Hidden: This one is pretty self-explanatory as well; if the file is marked hidden then under normal circumstances it is hidden from view. DOS will not display the file when you type "DIR" unless a special flag is used, as shown in the earlier example.

S = System: This flag is used to tag important files that are used by the system and should not be altered or removed from the disk. In essence, this is like a "more serious" read-only flag and is for the most part treated in this manner. It is also a "super-hidden" attribute. Even if you enable “Show hidden files”, system files will not be displayed. (You can display them by disabling “Hide protected operating system files.”)

D = Directory: This is the bit that differentiates between entries that describe files and those that describe subdirectories within the current directory. In theory you can convert a file to a directory by changing this bit. Of course in practice, trying to do this would result in a mess--the entry for a directory has to be in a specific format.

A = Archive: This is a special bit that is used as a "communications link" between software applications that modify files, and those that are used for backup. Most backup software allows the user to do an incremental backup, which only selects for backup any files that have changed since the last backup. This bit is used for this purpose. When the backup software backs up ("archives") the file, it clears the archive bit (makes it zero). Any software that modifies the file subsequently, is supposed to set the archive bit. Then, the next time that the backup software is run, it knows by looking at the archive bits which files have been modified, and therefore which need to be backed up. Again, this use of the bit is "voluntary"; the backup software relies on other software to use the archive bit properly; some programs could modify the file without setting the archive attribute, but fortunately most software is "well-behaved" and uses the bit properly. Still, you should not rely on this mechanism absolutely to ensure that your critical files are backed up.

Source

Missing from the above list:

C = Compressed: compressed files/folder cannot be encrypted.

E = Encrypted: encrypted files/folders cannot be compressed.

N = NOT INDEXED

L = Reparse Points

O = OFFLINE

P = Sparse File

I = Not content indexed

T = TEMPORARY

Combinations are possible, e.g., HSA = Hidden, System, Archive

Let-     Bit   
ter    masks Description and notes
--- -------- ---------------------------------------------------------------
 R       0x1 Read-only
 H       0x2 Hidden
 S       0x4 System
(V)      0x8 Volume label (obsolete in NTFS and must not be set)
 D      0x10 Directory
 A      0x20 Archive
 X      0x40 Device (reserved by system and must not be set)
 N      0x80 Normal (i.e. no other attributes set)
 T     0x100 Temporary
 P     0x200 Sparse file
 L     0x400 Symbolic link / Junction / Mount point / has a reparse point
 C     0x800 Compressed
 O    0x1000 Offline
 I    0x2000 Not content indexed (shown as 'N' in Explorer in Windows Vista)
 E    0x4000 Encrypted

(Attributes introduced in Windows 8:)
(V)   0x8000 Integrity (ReFS volume only)
 -   0x10000 Virtual (reserved by system and must not be set)
(X)  0x20000 No scrub (ReFS volume only)

(Attributes introduced in Windows 10, version 1703 (Creators Update):)
 -   0x40000 Recall on open
(P)  0x80000 Pinned (OneDrive "always available files")
(U) 0x100000 Unpinned (OneDrive "online-only files")
 -  0x200000 (Unused and reserved)
 -  0x400000 Recall on data access

Attributes shown in Windows Explorer (Windows 7 and later): RHSDAXNTPLCOIE ('X'=Device; 'P'=Sparse)

• X attribute in Windows Explorer (Normally you shouldn't see this attribute shown in Windows Explorer, but Panda USB Vaccine is known to exploit this attribute for "vaccinating" an FAT32 volume, effectively making the volume slightly corrupt.)
• Explorer in Windows Vista shows "Not content indexed" attribute as N (I personally consider this a bug.)

Attributes shown in 'attrib' command output (as of Windows 10, version 1703): A__SHR_OI_VX_P_U__ ('V'=Integrity; 'X'=No scrub; 'P'=Pinned)

Attributes shown in "%~a1" (FOR %%I IN (files) DO ECHO.%%~aI) output (as of Windows 10, version 1703): drahscotl-x ('X'=No scrub)

The authoritative reference of NTFS file attributes: https://msdn.microsoft.com/en-us/library/windows/desktop/gg258117(v=vs.85).aspx

The Pinned and Unpinned attributes are currently undocumented in the above reference, but their use in OneDrive as "always available file" and "online-only file" is noted in this German article. The two attributes can be modified in 'attrib' since Windows 10, version 1703. The attributes are not indicated in Attributes column in Windows Explorer, but in OneDrive status icons in Status column.

I haven't found this on the internet yet, but there is also a "P" attribute, corresponding to a sparse file. This flag is listed in Windows 7, but not in Windows XP. Not sure about Vista.

You can turn a file sparse with the fsutil sparse setflag FILENAME command, and see the flag appear in Explorer. Note that there is no way to turn off the flag, though!

Sparse files are similar to compressed files, but a bit more specific. With sparse files, long ranges of null (value 0) bytes are simply not stored on disk. When a program tries to access that part of the file, the file system will see that it is not on the disk and return a range of null bytes instead. See this MSDN page for more info on sparse files.