Questions tagged [ntfs]
New Technology File System, or NTFS, is a Microsoft file system that debuted with Windows NT. This file system is the default in Windows land and replaced the FAT and FAT32 file systems.
30 questions
1
vote
0
answers
167
views
Any Windows/NTFS trick to ignore/cancel out a file extension from a path?
I am pentesting an application. The application exposes a SOAP API, which I have access to, and internally that API makes the following call:
File.Open("C:\Resources\"+resName+".res&...
0
votes
0
answers
151
views
Is it possible to create an NTFS partition having only the $MFT and $J tables ? Forensics CTF
This is the third part of a forensics challenge in a European CTF, and it is apparently the most difficult one because only three people flagged it among 700 participating.
I'm only here for guidance ...
-1
votes
1
answer
176
views
Logical Methods to Protect Against Ransomware [closed]
I hate antivirus programs. They hinder more than help. I have some ideas but I have doubts about their practicality...
Can ransomware infect a FAT32 drive? (As I think they usually benefit from the ...
0
votes
1
answer
1k
views
Windows/NTFS: do files have any unique, immutable properties?
I want to detect if a file on disk was edited since last access, or restored since last deletion. Let's assume this isn't on a VM.
Basic scheme:
Somewhere in the file is a cryptographic hash of the ...
- 143
0
votes
1
answer
415
views
USN Journal leaks information on exFAT-hosted files (in VeraCrypt containers)
I'm using a secondary drive to store encrypted files, in VeraCrypt file containers.
Unfortunately, even if the external drive is formatted as exFAT, Windows leaks information on files inside mounted ...
- 103
0
votes
1
answer
736
views
Bypass NTFS Encryption via Password Change (Encrypting File System)
Is it possible to bypass NTFS encryption if the password used to encrypt the RSA key is a password to an AD account? So if an administrator can simply change your password, they would then be able to ...
- 708
0
votes
1
answer
252
views
Recovering NTFS encrypted files from a USB drive on a different machine
I have some files on an NTFS USB drive.
The files were encrypted on a Windows 10 pc and copied to the USB.
I had to completely reinstall Windows on the PC. I do not have a backup of the USB files
I ...
- 1
1
vote
1
answer
1k
views
Identification of File Deletion Time
following problem:
A file is marked as being deleted without a tracked time-deletion date. However, timestamps such as File Accessed, Entry Modified etc. point e. g. to the 30.12.2019. Is it safe to ...
- 11
22
votes
2
answers
7k
views
Is NTFS encrypted by default?
Can an NTFS volume be read by forensics without having to log into the windows user or provide any passwords? aka can data be read straight from the sectors in clear text?
- 339
0
votes
0
answers
983
views
How to prohibit overwriting of Files
I have applied NTFS permissions to help protect a few files from accidental deletion. All the features do prevent users from accidentally/purposefully delete files. However, I am unable to find a ...
- 337
1
vote
1
answer
151
views
How files are allocated to memory in NTFS? [closed]
If a file is deleted in memory which is using NTFS and after that, I copied a new file, then where is the new file is allocated in memory?
Is the file allocated in the deleted memory space or it is ...
0
votes
1
answer
332
views
How do I need to secure my Windows Shares?
I am working on an Domain Controller / File Server on Windows Server 2012.
Lets say that I am from a school and that I have 3 OU's (or security groups)
Students
Staff
IT
When I create a shared ...
- 103
1
vote
1
answer
451
views
Read NTFS / EFS encrypted files on iOS with saved certificate
I have data saved on old NTFS-format hard disks which were encrypted on Windows machines, using EFS (the native file encryption system built into Windows). I encrypted selected files/folders, only, ...
- 11
4
votes
3
answers
6k
views
Where are NTFS security ACLs stored on Windows systems?
Are per-file and directory access permissions for an user or a group stored as part of the NTFS structures on-disk? Or are they recorded in the registry database for an installed Windows OS, or ...
- 101
2
votes
1
answer
414
views
How to understand how someone had ssh access, and how to remove CVE-2017-0358
I have a home server that was compromised recently, it has been used to mine some crypto currencies.
I have not stopped anything yet apart from locking ssh to my user only. The processes are still ...
- 123
1
vote
1
answer
224
views
How does this NTFS Bug work?
A while back, (about 1 month ago), I submitted an NTFS DoS vulnerability on exploit-db. It got accepted and is currently on the website, but I do not quite understand how the vulnerability works, and ...
- 83
1
vote
1
answer
122
views
Will granting access to data without owner approval set a bad precedent?
I work for a small company that does contract work that involves storing customer data on our servers for the duration of a project. We recently adopted more strict folder security in which each team ...
- 113
2
votes
1
answer
269
views
Write protect a partition
I have an HDD partition that contains a Karaoke song library of 400 GB. Backing it up is cumbersome at best and requires a large external drive and hours of time.
The library is the only thing on the ...
- 21
10
votes
3
answers
9k
views
Is denying write access an effective way to stop ransomware?
I'm looking for ways to defend against ransomware.
As part of this strategy I've come up with the idea to block myself from writing to as many locations (and files) as possible.
It may be assumed ...
- 9,820
1
vote
0
answers
109
views
Windows Protect Strorage Service store private key's cipher text?
I'm reading NTFS file encryption explanation from ntfs.com, and I think I have understood it quite well, except a baffle with a statement:
Protected Storage encrypts all private keys with Session Key,...
- 111
11
votes
4
answers
2k
views
How do Windows services access folders encrypted with NTFS EFS
If I understood correctly, when I enable NTFS encryption (EFS) for a specific folder in Windows, it uses specific account's user name/password (salted) to create asymmetric keys for data encryption ...
- 212
2
votes
2
answers
2k
views
Use NTFS permissions to prevent folder access on USB key
TL/DR: how to use NTFS permissions to prevent all users on other PCs from accessing a particular folder on an NTFS USB key?
BACKGROUND
I have an NTFS formatted USB key. The top level contains a ...
- 21
3
votes
1
answer
1k
views
Use RSA Encryption With ASP.NET
My goal is to implement asymmetric encryption in an ASP.NET website to secure user-entered Social Security Numbers. I want to encrypt the SSNs with a public key, and only display a masked version, to ...
- 45
1
vote
2
answers
1k
views
What are hardened ACLs for the Windows %systemroot% folder?
What are the recommended file permissions for %systemroot% in Windows 8.1? I couldn't find hardened file system permissions to apply to better secure a Windows installation.
- 359
4
votes
2
answers
22k
views
How to know when a file was deleted in a NTFS filesystem?
Is it possible to know when a file in a NTFS filesystem was deleted? For example, if you have the file in the recycle bin you have the metadata file that stores when the file was sent to the recycle ...
- 2,789
1
vote
1
answer
168
views
How can I temporary disable folders links like Users\All Users in order to perform a forensic analysis?
I'm doing a forensic analysis of a hard drive that I have imaged to a dd image. The image is a NTFS filesystem that I mount in my Windows system with FTK Imager in read-only mode.
Then, I search in ...
- 2,789
8
votes
4
answers
3k
views
Does a rewritten file on NTFS use the same blocks?
Suppose that we produce a sensitive document on a Windows 7 box, NTFS filesystem. As we write the document, it grows longer, and we keep saving it, which means that the editor overwrites it from the ...
- 2,315
8
votes
2
answers
13k
views
How can I view the NTFS $MFT using correct field names?
I am trying to view an NTFS master file table. Each tool I have used so far extracts all of the entries, but puts non standard headers such as STANDARD_INFORMATION_ON instead of say $...
- 301
0
votes
1
answer
932
views
How to enforce NTFS permission compliance?
I have to enforce NTFS permissions based on business roles. Each role (group in ADS) can be granted the permission to read or write a file server directory. I do not care about share permissions. I ...
- 492
4
votes
1
answer
565
views
Is NTFS file compression vulnerable to a CRIME-like attack when using an encrypted volume?
I know that content compression can cause SSL to be vulnerable to the CRIME attack, via changes in the content length when injected plaintext matches existing content. Does this principle carry over ...
- 136k