2

To analyse for fragmentation in Windows you are required to be an administrator.

What dangers could a disk analysis pose?

3

Taking a look at the Defrag Documentation of Microsoft Technet:

Locates and consolidates fragmented files on local volumes to improve system performance.

Now, imagine that you have an operating system with 3 users, only one of them being Administrator. How could and algorithm running unprivileged manage to access files that can't be read? Would not happen. Access to those files would be denied, and the defrag process will be suboptimal, since i cant calculate how spread is a file that is not owned by my unprivileged user inside a volume. And why an unprivileged user should have raw disk access to disk? There is no reason why, and it will allow users to circunvent all protection to disk devices that the OS create and ignore the access rights implemented by the filesystem.

Situation two: Imagine that the analyze tool has some "automatic administrator" configured(like runas /user:.\Administrator /savecred defrag C: /U /V). If this software has the ability to read information about files, and it had Administrator credentials saved, it could be a feasable attack vector to extract information from other users, using your unprivileged user that is running this software. It's just a matter of time to have some bug explored on functions used to open files called by your defrag binary.

That's why you cant give disk manipulation or raw disk access to non-admin users.

Related Stuff:

  • By the way, OS that are SSD aware, will NOT perform defrag. – mootmoot Jan 13 '17 at 13:17
  • Thats right. All moderns OSs knows that defrag is not needed on SSD hardware. – user28177 Jan 13 '17 at 13:23
1

Defragmentation or coherence control exists for almost any file system (think of fsck in Unix world). But by definition, it cannot use normal file system access functions which would hide the detailed implementations.

This is normally implemented by using direct low level disk sector accesses (on the disk partition). So that access along with the file system structure allows to read data from any file actually bypassing all file system access control. For that reason, it is normally reserved for administrator accounts.

0

First of all: Research whether Defragmentation really has any positive effect. I'd argue it's mostly snakeoil on modern Windowses, since their NTFS implementation is self-fragmentation-avoiding.

Then: For operating on a intrinsics-of-file-system layer, you need the same level of access as the file system – that is, full access to the raw disk.

Now, Operating Systems don't categorize for "good" and "potentially bad" programs, they simply characterize after "can only do the things this user is allowed" (which does not include direct disk access) and "things this user is not allowed to do".

0

What dangers could a disk analysis pose?

Might allow you to list all files (and their fragments) regardless of file owner, thus circumventing NTFS permissions.

0

Windows has no suid facilities like Unix, so there's no way to mark a vetted program to run as administrator. To achieve a similar effect, programs would need to install a service/driver to expose system operations to unprivileged users.

Microsoft probably decided it's not worth the trouble creating a disk defragment service, but many third-party defragmenter indeed support this.

As an alternative, an administrator can create an interactive scheduled task that runs the defagmenter as admin and grant normal users the permission to start it. When triggered, the Task Scheduler service will start it with appropriate permissions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.