NTFS – WindowsTechs.com

NTFS Permissions: A Comprehensive Guide

Posted on December 18, 2023 by Michael Reinders

Windows allows users to assign permissions to files and folders, for added security and to control which users can perform specific actions on files and folders. Learn all you need to know about basic permissions, folder permissions, user permissions, explicit permissions, and much more. What are NTFS permissions? NTFS permissions, first introduced with Microsoft Windows…

The post NTFS Permissions: A Comprehensive Guide appeared first on Petri IT Knowledgebase.

Continue reading NTFS Permissions: A Comprehensive Guide→

Hook Windows API /Win32 System calls

Posted on April 23, 2023 by Questions123

I want to monitor all Win32 API calls invoked by a certain process, and that’s it, so I don’t want to modify its behavior or jump to another DLL to perform a different operation. Do I really need to "hook" the API calls in such a… Continue reading Hook Windows API /Win32 System calls→

Hook Windows API /Win32 System calls

Posted on April 23, 2023 by Questions123

Any Windows/NTFS trick to ignore/cancel out a file extension from a path?

Posted on July 3, 2022 by PenetrationTester

I am pentesting an application. The application exposes a SOAP API, which I have access to, and internally that API makes the following call:
File.Open("C:\Resources\"+resName+".res", FileMode.Open)

The contents of tha… Continue reading Any Windows/NTFS trick to ignore/cancel out a file extension from a path?→

Calculations of NTFS Partition Table Starting Points [closed]

Posted on March 24, 2022 by Ahmet Furkan Aydogan

I have a disk image. I’m able to see partition start and end values with gparted or another tools. However, I want to calculate them manually. I inserted an image , which showing my disk image partition start and end values. Also, I insert… Continue reading Calculations of NTFS Partition Table Starting Points [closed]→

Is it possible to create an NTFS partition having only the $MFT and $J tables ? Forensics CTF

Posted on October 22, 2021 by Anass Naqqad

This is the third part of a forensics challenge in a European CTF, and it is apparently the most difficult one because only three people flagged it among 700 participating.
I’m only here for guidance on what could be done and only want an … Continue reading Is it possible to create an NTFS partition having only the $MFT and $J tables ? Forensics CTF→

A Contemporary Investigation of NTFS File Fragmentation

Posted on October 19, 2021 by Forensic Focus

Hello, everybody. Greetings from the Netherlands and welcome to this presentation called “A Contemporary Investigation on NTFS File Fragmentation”. In the next 20 minutes, I will tell you all about the research and our paper, which has the same t… Continue reading A Contemporary Investigation of NTFS File Fragmentation→

Logical Methods to Protect Against Ransomware

Posted on October 6, 2021 by Ricardo Ramos

I hate antivirus programs. They hinder more than help. I have some ideas but I have doubts about their practicality…

Can ransomware infect a FAT32 drive? (As I think they usually benefit from the NTFS encryption feature, FAT32 doesn’t h… Continue reading Logical Methods to Protect Against Ransomware→

Windows/NTFS: do files have any unique, immutable properties?

Posted on July 27, 2021 by Tyson

I want to detect if a file on disk was edited since last access, or restored since last deletion. Let’s assume this isn’t on a VM.
Basic scheme:

Somewhere in the file is a cryptographic hash of the file’s last access date/time. Any modifi… Continue reading Windows/NTFS: do files have any unique, immutable properties?→

Deleted NTFS file inode referenced blocks zero binary data content?

Posted on June 30, 2021 by Gábor DANI

I accidentally deleted some of the files on my NTFS hard drive.
I immediately shut down the computer and created a disk image, of which I extracted the partition image.
I am able to obtain the inodes and file names from it:
fls -rd image.d… Continue reading Deleted NTFS file inode referenced blocks zero binary data content?→