ntfs

Taking ownership of files with 'broken' permissions

由 拟墨画扇 提交于 2019-11-27 22:26:02
I'm trying to overcome the following situation. Given a directory stored on an NTFS volume, where: The directory owner is set to someone else (a non-privileged user for example) The directory DACL is configured to permit access to a specific group of people that does not include the system or Administrators The DACL on the directory actually grants no one access to either take ownership or change the DACL (or in short, the all administrators have been locked out of the folder) But! The account I am running under has administrative rights (SeBackupPrivilege, SeSecurityPrivilege) The existing

GetFullPathNameW and long Windows file paths

由 三世轮回 提交于 2019-11-27 16:51:49
问题 In the Windows version of my current personal project, I'm looking to support extended length filepaths. As a result, I'm a little confused with how to use the GetFullPathNameW API to resolve the full name of a long filepath. According to the MSDN (with regards to the lpFileName parameter): In the ANSI version of this function, the name is limited to MAX_PATH characters. To extend this limit to 32,767 wide characters, call the Unicode version of the function and prepend "\?\" to the path. For

What is the difference between NTFS Junction Points and Symbolic Links?

由 限于喜欢 提交于 2019-11-27 10:17:10
At a high level, the only obvious difference between NTFS Junction Points and Symbolic Links is that Junctions are only able to be directories, while SymLinks are allowed to also target files. What other differences between the two exist? (Note, I've already seen this question and what I'm looking for is a bit different -- that question is looking for a pro and con list, I'm looking for a set of technical differences) Symbolic links have more functionality, while junctions almost seem to be a legacy feature because of their limitations, but the security implications of these limitations are

How do the UNIX commands mv and rm work with open files?

由 一世执手 提交于 2019-11-27 08:55:16
If I am reading a file stored on an NTFS filesystem, and I try to move/rename that file while it is still being read, I am prevented from doing so. If I try this on a UNIX filesystem such as EXT3, it succeeds, and the process doing the reading is unaffected. I can even rm the file and reading processes are unaffected. How does this work? Could somebody explain to me why this behaviour is supported under UNIX filesystems but not NTFS? I have a vague feeling it has to do with hard links and inodes, but I would appreciate a good explanation. Unix filesystems use reference counting and a two-layer

Get file offset on disk/cluster number

由 若如初见. 提交于 2019-11-27 08:02:26
问题 I need to get any information about where the file is physically located on the NTFS disk. Absolute offset, cluster ID..anything. I need to scan the disk twice, once to get allocated files and one more time I'll need to open partition directly in RAW mode and try to find the rest of data (from deleted files). I need a way to understand that the data I found is the same as the data I've already handled previously as file. As I'm scanning disk in raw mode, the offset of the data I found can be

C++/Win32: How to wait for a pending delete to complete?

由 一笑奈何 提交于 2019-11-27 03:57:12
Solved: * Workable Solution: @sbi * Explanation for what really happens: @Hans * Explanation for why OpenFile doesn't pass through "DELETE PENDING": @Benjamin The Problem: Our software is in large part an interpreter engine for a proprietary scripting language. That scripting language has the ability to create a file, process it, and then delete the file. These are all separate operations, and no file handles are kept open in between these operations. (i.e. during the file create a handle is created, used for writing, then closed. During the file processing portion, a separate file handle

How to obtain the target of a symbolic link (or Reparse Point) using .Net?

由 情到浓时终转凉″ 提交于 2019-11-27 03:29:38
问题 In .NET, I think I can determine if a file is a symbolic link by calling System.IO.File.GetAttributes(), and checking for the ReparsePoint bit. like so: var a = System.IO.File.GetAttributes(fileName); if ((a & FileAttributes.ReparsePoint) != 0) { // it's a symlink } How can I obtain the target of the symbolic link, in this case? ps: I know how to create a symbolic link. It requires P/Invoke: [Interop.DllImport("kernel32.dll", EntryPoint="CreateSymbolicLinkW", CharSet=Interop.CharSet.Unicode)]

Encountering a FileSystemRights value that isn't defined in enumeration

由 痞子三分冷 提交于 2019-11-27 02:49:38
问题 I've written an application that examines all of the file system permissions on a directory. A directory has a number of access rules (of type FileSystemAccessRule ). Each access rule has a property FileSystemRights , which is a flag enumeration. When running this, I keep encountering a FileSystemRights value of 268435456 (which comes to 0x10000000 in hexadecimal). This value just doesn't appear in enumeration! It's actually higher than the highest single flag value ( Synchronize , having a

How to see if a subfile of a directory has changed

由 故事扮演 提交于 2019-11-27 02:24:51
问题 In Windows, is there an easy way to tell if a folder has a subfile that has changed? I verified, and the last modified date on the folder does not get updated when a subfile changes. Is there a registry entry I can set that will modify this behavior? If it matters, I am using an NTFS volume. I would ultimately like to have this ability from a C++ program. Scanning an entire directory recursively will not work for me because the folder is much too large. Update: I really need a way to do this

Create NTFS junction point in Python

由 拟墨画扇 提交于 2019-11-27 01:37:41
问题 Is there a way to create an NTFS junction point in Python? I know I can call the junction utility, but it would be better not to rely on external tools. 回答1: I answered this in a similar question, so I'll copy my answer to that below. Since writing that answer, I ended up writing a python-only (if you can call a module that uses ctypes python-only) module to creating, reading, and checking junctions which can be found in this folder. Hope that helps. Also, unlike the answer that utilizes uses
订阅 ntfs