File and Folder Ending with Period/Dot

This is a small test on NTFS.

Usually there is no way for you to have file or folder name that ends with a "period" or "dot". For example, you create a new folder called "F1.", Windows OS will rename it to "F1".

One day, I save a PDF file to my Windows 7 (64-bit) from SANS (using Chrome), and for some reasons the file is saved as an ending "dot". And I can't open/del/ren/mov the file. I even try to remove the folder that contain the file but still fail.

After a quick search, here's what I found this, http://support.microsoft.com/kb/320081
But to have fun on this, you still can try.

To Create a File or Folder that ends with "dot":

c:\mkdir \\?\c:\folder.
c:\echo test > \\?\c:\file.

To Remove a file or folder that ends with "dot":

c:\rmdir \\?\c:\folder.
c:\del \\?\c:\file.

Basically those files and folders can't be accessed at all. And you can't rename or move them. Have fun!

HTG Explains What is the Linux fstab

A lot of people don't know that Linux /etc/fstab stands for 'file system table'. And not many people are comfortable to modify the configuration of it.

• Do you know why it starts with UUID?
• Do you know you can mount NTFS partition with ntfs-3g driver?
• How about the options? auto/noauto? exec/noexec? ro/rw? sync/async? user/nouser?
• Do you know that "user" option automatically implies "exec"?
• What are dumping and pass?

Some of the minor settings are really new to me. For example, "sync" forces writing to occur immediately on execution of the command, which ideal for floppies and USB drives, but isn't entirely necessary for internal hard disk. What "async" does is allow the command to execute over an elapsed time period, perhaps when user activity dies down and the like. This is usually why you ever get a message asking you to "wait while changes are being written to the drive".

Go read the article to refresh some memory at http://www.howtogeek.com/howto/38125/htg-explains-what-is-the-linux-fstab-and-how-does-it-work/

NTFS Alternate Data Stream

Today, I decide to refresh my memory on NTFS ADS (Alternate Data Stream).

Ever since Windows 2000, the NTFS file system in Windows has supported Alternate Data Streams, which allow you to store data “behind” a filename with the use of a stream name. It is only available at NTFS file system and it isn't detectable while browsing the file system.

First you create an innocent file, for instance, called "default.txt" with Notepad. You can put any text into the file.

Secondly, to create a new stream that attach to the first file created. You can:

notepad default.txt:secret1.txt

And you can put any text into this new stream file, default.txt:secret1.txt. If you browse the folder that contains the file, you won't see it. You only see default.txt.

Next, you can also add text into the stream using command line:

echo "The quick brown fox jumps over the lazy dog." >> default.txt:secret1.txt

You also can read the text from the stream using command line:

more < default.txt:secret1.txt

Of course, you can always add second stream and view them in command line:

echo "The quick brown fox jumps over the lazy dog." >> default.txt:secret2.txt
more < default.txt:secret2.txt

Note that the file size for default.txt is not changed even you put a MB file into the stream. Then, to detect ADS, you may use a tool (cmdline) called "streams.exe" from Microsoft. The tool allows you to view if there is any stream attaching the file or not. It also allows you to strip all the streams (if any) from the file:

stream -d default.txt

Advanced Usage of ADS
We can make a new stream to not only file, but also folder. For example:

md folder1
cd folder1
echo "Hidden text in ADS" > :hidden.txt
more < :hidden.txt

Now, we will begin to store an EXE file as ADS and run it.

type c:\windows\notepad.exe >  default.txt:note.exe
start .\default.txt:note.exe

However, I notice that running it under Windows 7 seems doesn't work any more. Lastly, if you wish to retrieve back the executable file from the stream, you may:

cat default.txt:note.exe > note.exe

See practical guide to ADS for more information.

NTFS-hacked in USB without Hacking

I know there are many tools out there to allow you to format a USB thumb/flash drive to NTFS. By default, Windows allow your USB to be formatted to FAT only. Here's the instruction to allow you to format your USB to NTFS without any hacking.

1. After plug in your USB, open "My computer".
2. Right click "My Computer, select "Manage".
3. Open the 'Device Manager' and find your USB drive under the 'Disk Drives' heading.
4. Right click the drive and select 'Properties'.
5. Choose the 'Policies' tab and select the 'Optimize for performance' option.
6. Click 'OK' to close it.
7. Now, open 'My Computer'.
8. Right click the USB drive and select 'Format'.
9. Choose 'NTFS' in the File System dropdown box.
10. Click 'Start' to format it in NTFS.