how to interpret FILENAME attribute of NTFS MFT?

Question

I have read NTFS MFT. Here is the picture (in 4 byte words, lower address is shown to the left)

The highlighted region is the filename attribute. and below is the attribute format.

typedef struct _NTFS_ATTRIBUTE {
unsigned int dwType;
unsigned int dwFullLength;
unsigned char uchNonResFlag;
unsigned char uchNameLength;
unsigned short wNameOffset;
unsigned short wFlags;
unsigned short wID;
   union ATTR {
   struct RESIDENT {
      unsigned int dwLength;
      unsigned short wAttrOffset;
      unsigned char uchIndexedTag;
      unsigned char uchPadding;
   } Resident;
   struct NONRESIDENT {
      unsigned long long n64StartVCN;
      unsigned long long n64EndVCN;
      unsigned short wDatarunOffset;
      unsigned short wCompressionSize;
      unsigned char uchPadding[4];
      unsigned long long n64AllocSize;
      unsigned long long n64RealSize;
      unsigned long long n64StreamSize;
   } NonResident;
   } Attr;
} _NTFS_ATTRIBUTE, *P_NTFS_ATTRIBUTE;

THe dwType is 0x00000030 (FILENAME) , dwFullLength is 0x00000068 as you see. wNameOffset is 0x0018, wID is0x0003. This is a resident case, and the Resident has dwLength 0x0000004a, wAttrOffset 0x0018, uchIndexedTag 0x01, and uchPadding 0x00. Since the offset is 0x18 from the start of the attribute record. it is shown below.

I don't know how to read this unicode character string. Is is utf-16? every character is 16 bit?

Answer 1

according to
https://www.mandiant.com/blog/incident-response-ntfs-indx-buffers-part-2-internal-structures-file-attribute/
The 'file name' attribute has its structure. According to it the length of the filename is 4 and the value is "$MFT".

Answer 2

it looks like it is UTF-16 - according to the Windows Internals book - i looked it up online and everything suggests that it is UTF-16 and while the internals book doesn't make it explicitly clear it does say unicode(and specifies non-unicode for the FAT FS) - which in the microsoft world implies UTF-16.

While I'm not 100% certain, if it is a 32-bit or higher system I would say UTF-16 is a safe bet.

To answer the last part - yes, unicode is 2-byte or 16-bit characters.