Vulnerability Development mailing list archives
Re: Windows file problem
From: "Doe, John" <LeaveMeHigh () AOL COM>
Date: Sat, 7 Oct 2000 14:11:38 EDT
In a message dated 10/7/00 11:01:11 AM Pacific Daylight Time, poepping () LOGICAL CM NU writes:
Am I mising something? or is this just a flaw in windows (tested on windows nt 4.0 doesn't seem to work on windows 98, but need to try creating the file with vi.exe)
From MSDN:
o Streams It’s little known that NTFS allows a single file to have multiple data streams. This feature has actually been in NTFS since its very first version (in Windows NT 3.1) but has been downplayed by Microsoft. This is unfortunate because streams can be incredibly useful in many situations. ... To understand how this works, let’s perform an experiment. On a Windows NT-based machine (any version) open a command shell. Then change to an NTFS partition and enter the following: C:\>ECHO “Hi Reader” > XX.txt:MyStream When you execute this command, the system creates a file called XX.txt. This file contains two streams: an unnamed stream that contains 0 bytes and a named stream (called MyStream) that contains the text “Hi Reader”. If you haven’t guessed by now, you access a file’s named stream by placing a colon after the file name followed by the name of the stream. As with file names, Win32® functions treat stream names as case-preserved and searches are case- insensitive. Unfortunately, the tools supplied with the system treat streams as second class citizens at best. For example, execute the following command: C:\>DIR XX.txt Volume in drive C is Wizard Volume Serial Number is 40E5-92D4 Directory of C:\ 03/18/98 08:36a 0 XX.txt 1 File(s) 0 bytes 0 Dir(s) 3,399,192,576 bytes free As you can see, DIR reports that the file size is 0 bytes, but this is not true. The DIR command only reports to the user the size of a file’s unnamed stream; the sizes of named streams within the file are not shown to the user. By the way, Explorer also reports a file size of 0 bytes. This allows for some geeky party games where you can allocate a large stream in a file on a friend’s disk. The friend won’t be able to discover where all the disk space has gone because all of the tools report that the file occupies only 0 bytes! When working with streams, remember that it’s only the tools that don’t treat streams with the respect that they deserve; NTFS has full support for streams (they even count against your storage quota). Now, to see the contents of the stream, execute this command: C:\>MORE < XX.txt:MyStream “Hi Reader” ... Thus, a feature, not a bug... -lmh
Current thread:
- Windows file problem poepping (Oct 07)
- Re: Windows file problem Kris Carlier (Oct 07)
- Re: Windows file problem Blake Frantz (Oct 07)
- Re: Windows file problem Simple Nomad (Oct 09)
- <Possible follow-ups>
- Re: Windows file problem Doe, John (Oct 07)
- Re: Windows file problem Flaherty, Jack (Oct 09)
- Re: Windows file problem Paul Taylor (Oct 09)
- Re: Windows file problem Kevin van Haaren (Oct 16)
- Re: Windows file problem Brian Battle (Oct 10)