Quantcast
Channel: Forensic Focus Forums - Recent Topics
Viewing all articles
Browse latest Browse all 20102

General Discussion: $MFT Resident data

$
0
0
randomaccess wrote: can you post up the files when they are at the maximum data attribute length for each process? (I dont know why that sentence was so difficult to phrase)OK, started again from scratch. <img src="images/smiles/icon_smile.gif" alt="Smile" title="Smile" /> Here: http://www2.zshares.net/vac5zybch4of is a small (around 3 Mb) "floppy-like" image (suitable for being mounted in IMDISK or similar) with a set of pre-made files AND the tools and batches used to make them. The size was chosen as it is (roughly) the smallest size you can make a NTFS filesystem in windows with a 4096 bytes cluster (i.e. same size as most "common" NTFS filesystems on disk) with the built-in in XP format command. There is (as seen) a connection between filename length and "available space", but still fsz and fsutil *somehow* manage to make smaller sized files. 744 is confirmed to be the most you can put in a file which filename is within these lengths/form: Quote:: 1 12 1.1 123 The algorithm (valid for "normal" file generation through dsfo or ECHO/ECHOO and similar) is simple enough (by design this applies only up to 8.3 filenames), in batch: Quote:: SET Max_size=744 SET /A Sum=%Name_length%+%Ext_length%-1 IF %Sum% geq 3 Set Max_size=736 IF %Sum% geq 7 Set Max_size=728fsz and fsutil "steal"<img src="images/smiles/icon_eek.gif" alt="Shocked" title="Shocked" /> 8 bytes from the above. jaclaz

Viewing all articles
Browse latest Browse all 20102

Trending Articles