Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

So I heard this guy talkin about how one time he deleted someone's windows directory remotely. He claimed to have gotten into the system and deleted it such that the files are all still there, but the OS can't find them. I might be coming up with the wrong name.... But about my specific question: how did he do this and how can I protect myself from it? I'm guessing he SSH'ed into the guy's system and just did it from the command line. I'm looking for more info on this potential security hazard. Thanks.

share|improve this question
I don't see any security hazard here. If you can SSH into a box, you can run commands on it, including deleting files. If you want to protect against someone deleting your files, don't give them access to your files. As for the “deleted it such that the files are still there”, deleted files' content can remain on the disk (or the files could be in a recycle bin or something). There's nothing mysterious about the principle, and unless you can give more details, I don't see how we could ferret the specific events out of your mind. – Gilles Apr 18 '12 at 22:26

closed as not a real question by Gilles, AviD♦ Apr 18 '12 at 22:29

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.

1 Answer

up vote 1 down vote

I don't know what OS it is he used, it sound more like windows as NTFS filesystem supports alternate data streams which could be used to make the file look empty even though it contains data.

Also a delete on most filesystems only deletes an index entry or marks it as deleted for overwrite in the future, could this be what he was incorrectly referring to?

share|improve this answer
Yes, I believe it was windows. But I still think it was like he deleted just the part that tells the OS where the data is... – Justin Apr 18 '12 at 0:54
All filesystems have some kind of index, as far as the filesystem driver goes if file is in index it is there, else it's not. Delete on most file systems only delete or mark this entry, data still exists until it is actually overwritten. This is the only form of delete (though some filsystems can have multiple entries to a single file, on 'nix these are hard links and file is considered deleted when all are removed), there only other form of delete is secure wipe methods which overwrite the data area. – ewanm89 Apr 18 '12 at 2:57
That must be what he did then. My question is: how did it happen remotely? Would the os even allow deletion of the index? – Justin Apr 18 '12 at 10:00
that's what standard file delete does, as in del or rm (depending on OS), I'm simplifying how the index works slightly, but they all do that the same way to some degree. – ewanm89 Apr 18 '12 at 14:25

Not the answer you're looking for? Browse other questions tagged or ask your own question.