Convert to FAT to remove NTFS permissions.

Printable View

April 29th, 2002, 04:46 PM
jaggz

Convert to FAT to remove NTFS permissions.

Using a partition program such as Powerquest Partition Magic, an entire NTFS hard drive can be converted to FAT from NTFS. This conversion removes all NTFS file and folder security. Once the conversion from NTFS to FAT is complete, a DOS based operating system can be used to access all previous NTFS protected files and folders.

A DOS bootable disk can be made using Partition Magic that allows the program to boot the computer into DOS to run the DOS version of Partition Magic. From there a user can convert all NTFS partitions from NTFS to FAT 16 or FAT 32. As far as I know, there are two ways to prevent this type of access. Boot the system to BIOS setup and disable floppy read/write access. Then set a password for the BIOS to prevent any BIOS settings from being changed. Unfortunately not all BIOS have these security features, especially in OEM boxes or laptops.

Of course there are ways around the BIOS protection. The case could be opened and the small dime shaped battery removed, wait a few seconds, and replace the battery. This procedure resets the BIOS including the password etc.
April 29th, 2002, 04:53 PM
Noia

Sound's good to me...I think only School Admin's have to worry bout stuff like this...who else would be buggered to try and do all this crap if theyr not student;s :)
- Noia
PS: I'm a studen't and I'v acctualy done this once to anoy our Admin....lol
April 29th, 2002, 05:07 PM
jaggz

I was a school admin...a long time ago....now I know who did it. ;-)

It could be a valid problem for large companies which have thousands of laptops which are docking stations. Employees taking their laptops home so that someone could make a disk image of the hard drive, convert the image to FAT and look at all kinds of interesting information such as how the VPN is setup through Terminal Server, passwords for shared network drives, hash files of Domain Admins etc.
April 29th, 2002, 05:15 PM
Tedob1

i havn't had need for this yet, but it's good to know!
April 29th, 2002, 05:15 PM
krang

Why go to all that trouble when you can just plug it in as a slave in another system?

Krang
April 29th, 2002, 06:04 PM
jaggz

Plugging in as a slave is fine if you can get past the NT logon and NTFS file encryption.
April 29th, 2002, 08:52 PM
knightmb

Re: Convert to FAT to remove NTFS permissions.

Quote:

Originally posted here by jaggz
Using a partition program such as Powerquest Partition Magic, an entire NTFS hard drive can be converted to FAT from NTFS. This conversion removes all NTFS file and folder security. Once the conversion from NTFS to FAT is complete, a DOS based operating system can be used to access all previous NTFS protected files and folders.

A DOS bootable disk can be made using Partition Magic that allows the program to boot the computer into DOS to run the DOS version of Partition Magic. From there a user can convert all NTFS partitions from NTFS to FAT 16 or FAT 32. As far as I know, there are two ways to prevent this type of access. Boot the system to BIOS setup and disable floppy read/write access. Then set a password for the BIOS to prevent any BIOS settings from being changed. Unfortunately not all BIOS have these security features, especially in OEM boxes or laptops.

Of course there are ways around the BIOS protection. The case could be opened and the small dime shaped battery removed, wait a few seconds, and replace the battery. This procedure resets the BIOS including the password etc.

You forget to mention the file size limitation of this which could lead to a major system meltdown if you are not careful.

FAT16 = 2GB limit on partition size (Gigabytes)
FAT32 = 32GB limit on partition size (Gigabytes) **In theory it should be 8 terabytes**
NTFS = 2TB limit on partition size (Terabytes) **Again, in theory should be 16 terabytes**

Keep these in mind if you do this ;)

Also, Windows NT 4.0 / 2000 / XP will support a 4GB FAT16 partition if you want to try it. Doesn't work for the other 95/98/ME :(
May 3rd, 2002, 04:29 AM
jaggz

System meltdown? I think you misunderstood the purpose of my post. What I described is a crude method which could be used to gain information from an NTFS drive, ...... a security issue. I would not expect to convert a drive from NTFS to FAT32 and then boot the same OS.

It is apparent from your closing statement of a 4GB FAT partition running a 32bit OS, that you misunderstood the purpose of my original post which was to alert admins etc, of the availability of software which can convert NTFS to other partition types rendering the NTFS security features worthless.

Your info on FAT32 partition size is wrong. The limit is 2 terabytes. I have formatted 100GB drives as FAT32.
May 3rd, 2002, 04:44 AM
jaggz

System meltdown? I think you misunderstood the purpose of my post. What I described is a crude method which could be used to gain information from an NTFS drive, ...... a security issue. I would not expect to convert a drive from NTFS to FAT32 and then boot the same OS.

It is apparent from your closing statement of a 4GB FAT partition running a 32bit OS, that you misunderstood the purpose of my original post which was to alert admins etc, of the availability of software which can convert NTFS to other partition types rendering the NTFS security features worthless.

Your info on FAT32 partition size is wrong. The limit is 2 terabytes. I have formatted 100GB drives as FAT32.
May 3rd, 2002, 05:26 AM
{P²P}Apocalypse

An exception to this rule is if you use EFS along with NTFS. You can still use several methods to acess the data on the drive, but it all will come up garbage. Also it's good to use a mounted pgp disk or some other type of third party crypto to prevent access to the data itself. Either individualy encrypt the seledted files and/or folders or have an encrypted volume or partition that you can mount or dismount.
May 3rd, 2002, 06:39 AM
cwk9

Why convert the entire drive when you could just put ntfsdos.exe on a boot disk and copy the files you need? At least that way there’s no evidence that you were messing with the system. {P²P}Apocalypse is right about the only way to stop some one who has physical access to the machine is to encrypt stuff. As you can see ntfs security is almost as big of a joke as FAT32/16.
May 6th, 2002, 05:30 PM
knightmb

Quote:

Originally posted here by jaggz
System meltdown? I think you misunderstood the purpose of my post. What I described is a crude method which could be used to gain information from an NTFS drive, ...... a security issue. I would not expect to convert a drive from NTFS to FAT32 and then boot the same OS.

It is apparent from your closing statement of a 4GB FAT partition running a 32bit OS, that you misunderstood the purpose of my original post which was to alert admins etc, of the availability of software which can convert NTFS to other partition types rendering the NTFS security features worthless.

I understood your post, was watching out for others that read your post. It was to warn those who might try it at home and not realize that this process will either destroy the file system, thus you won't have access to any of the files or the system will die and never work again until it's repartitioned or you go in and manually repair the file system. Changing file system formats may/may not work, just wanted to warn those that might try it. Have you ever tried to convert a partition in PQMagic that had 32 Gigabytes or greater or data on it? I've tried with version 7.0 and it bombs the file system. No recovery from this and you lose all the data.

Quote:

Your info on FAT32 partition size is wrong. The limit is 2 terabytes. I have formatted 100GB drives as FAT32.

Microsoft File System info
http://support.microsoft.com/default...;en-us;Q184006

Yeah, formatting isn't the same as converting is it? Actually, according to Microsoft your wrong also since they state it will work up to 8 terabytes. I've only formatted drives at 4 terabytes just for fun here in the lab, we haven't had anything bigger come by yet. I don't think a 100GB HDD is a good way to back up a claim about partition sizes is it?
May 7th, 2002, 07:51 PM
mohaughn

There are a lot easier ways to do this.

Get a floppy version of linux and use the NTFS file system utility. From there you can actually just crack passwords, and get the login to the machine. It is also possible to change passwords this way, assuming the admin has not gone way beyond most in hardening the system.

Pull the drive and put it in another system, or put another drive in this system, load NT on the new drive. Then you can just change the permissions however you like via NT.

NTFS is not intended to secure your system against someone who has physical access to the machine. No file system that does not use some type of PKI encryption will prevent someone who has physical access from seeing the data. MS or otherwise.