0

I want to detect if a file on disk was edited since last access, or restored since last deletion. Let's assume this isn't on a VM.

Basic scheme:

Somewhere in the file is a cryptographic hash of the file's last access date/time. Any modification to the file after this point will result in a hash mismatch.

Problem:

The file could be modified and then have its modification date manually restored to the previous value using SetFileTime, so a hash mismatch does not occur.

This scheme is easy to overcome because all easily-accessible file access properties are mutable (date of creation, modification, access, etc).

Do files within an NTFS file system have any immutable properties? Maybe an MFT sector index or something? Something that would be specific/unique to each file but not something that can be changed manually?

In my actual use case I'm looking for a way to detect if a file has been restored after deletion. The contents would be the same before/after delete...but if there's some immutable disk property that would be different between the original/restored versions, I could use that as a point of comparison...

3
  • All of said properties are outside your controle…. Meaning they could change for any reason (from disk optimization to bad sector move). You could add your own property to the file meta table list, however a copy of the file would have the same property (if done correctly). What is it you are trying to make a defense for/ against?
    – LvB
    Jul 27, 2021 at 7:29
  • @LvB I want to revoke a license file for activated software (the user would knowingly trigger the revoke when de-activating a node-locked machine license in order to migrate the license) and am trying to avoid a situation where the license is migrated and then the user just restores the license file on the previous machine. Being able to remove a license file by deleting it, and preventing a restored version from having a matching hash, is the goal. I thought maybe hashing a value in the file's RETRIEVAL_POINTERS_BUFFER would work, but you're saying those could change during disk optimize?
    – Tyson
    Jul 27, 2021 at 7:53
  • 1
    Well. You don’t controle the underlaying file system, one that is not setup to track what you need… what you could do is have a validation server that periodically checks the license. And or add something to the Alternative Data Streams (ADS) that you set with some safeguards… like a hash of the file and a time check with some hash validation of both… however every such thing would be easy to circumvent…
    – LvB
    Jul 27, 2021 at 8:07

1 Answer 1

1

Short answer is no they do not.

If you have full control on the filesystem, there are various possible tools, like the NTFS access properties which allow to say precisely what a user can do with a file or a directory. You could also probably use audit events if you have full control on a system.

But if the file is in a system that is controlled that the user, the most you can do is to use obfuscation technics, meaning hard to guess ways, but that can certainly circumvented by a voluntary user. For example you could write additional data in different places on the filesystem and on the registry. If all are consistent, then the system is clean. If they are not something has happened and you should ask the a network validation before rewriting the correct pieces of information.

BTW, in the early times of Windows, Microsoft produced the same system for its server and client versions, used 2 different registry keys to store the actual configuration and used a system task that continuously controlled that both keys were the same. And SysInternals managed to identify the method and break it... So do not expect to imagine a non breakable trick :-(

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .