How Windows 95 Processed File Attributes

This article examines how Windows 95 managed standard file attributes—specifically Read-Only, Hidden, System, and Archive. By bridging 16-bit MS-DOS conventions with a modern 32-bit graphical user interface, Windows 95 used the underlying File Allocation Table (FAT) file system to store attribute bits, enforcing system integrity, tracking file changes, and dictating how files appeared and interacted within the operating system shell and command-line environments.

The Storage Mechanism: FAT Directory Entries

Windows 95 introduced the VFAT (Virtual FAT) driver, which added support for long filenames while maintaining full backward compatibility with the traditional FAT12 and FAT16 formats. At the storage layer, file attributes were not separate data streams; they were recorded in a dedicated 8-bit attribute byte within each 32-byte directory entry on the disk.

The system assigned specific bit flags to manage each attribute:

  • Bit 0 (0x01) - Read-Only (R)
  • Bit 1 (0x02) - Hidden (H)
  • Bit 2 (0x04) - System (S)
  • Bit 5 (0x20) - Archive (A)

(Bits 3 and 4 were reserved for Volume Labels and Subdirectories, respectively).

How Windows 95 Processed Each Attribute

1. Read-Only

When the Read-Only bit was set, low-level file write and delete operations were rejected by the file system. In Windows 95, applications attempting to open the file with write permissions received an ACCESS_DENIED error. At the shell level, Windows Explorer warned users before moving or deleting a Read-Only file, prompting a confirmation dialog to prevent accidental deletion.

2. Hidden

The Hidden attribute designated files meant to remain out of sight during ordinary user navigation. Windows 95 processed this through shell display filters. By default, Windows Explorer excluded Hidden files from directory listings. Users had to explicitly enable "Show all files" under the View Options menu to reveal them. When visible, Explorer rendered Hidden file icons as slightly translucent.

3. System

The System flag identified core files necessary for booting or running the OS, such as IO.SYS or MSDOS.SYS. Windows 95 treated System files with higher security safeguards than typical files. They were hidden from directory views alongside Hidden files, and Explorer presented strong warning dialogues if a user attempted to delete, rename, or move a file with the System attribute enabled.

4. Archive

The Archive bit was an automated tracking flag used primarily by backup software. Windows 95 handled this dynamically: whenever a file was created, written to, or altered, the VFAT driver automatically asserted the Archive bit (set to 1). Backup software, including the bundled Microsoft Backup utility, would clear the bit (set to 0) upon a successful backup. A set Archive bit signified to the OS and third-party tools that the file had changed since the previous backup cycle.

The Processing Architecture: API and Subsystems

Windows 95 processed these attributes through a multi-tiered architecture:

  • VFAT.386 and IFSMgr: The Installable File System Manager (IFSMgr) and the 32-bit protected-mode driver VFAT.386 directly read and modified the attribute byte in the FAT structure.
  • Win32 File APIs: 32-bit Windows applications manipulated these flags via native functions such as GetFileAttributes() and SetFileAttributes().
  • MS-DOS Interrupt 21h Compatibility: For 16-bit legacy software running inside DOS virtual machines (VDMs), the system intercepted INT 21h, Function 43h calls, translating legacy MS-DOS attribute requests into corresponding VFAT operations seamlessly.
  • Command Line and Properties Dialog: Users managed these attributes either through the graphical Properties dialog in Windows Explorer (which exposed checkboxes for all four attributes) or via the MS-DOS Prompt using the ATTRIB command (e.g., attrib +h +r filename.ext).