-
Data Security
In the days of 9x there were so many utilities that were released to perform a secure copy excluding all the data that would be transfered in the slack space of a file. Now in the days of NT/2K/XP/2K3 there is less and less call for a secure copy or the exclusion of any data that may be transferred unaware by a copy. Is this no longer a concern with the NTFS file system or is there something many people are over looking? Also, if you are transferring information from a source of media formatted in FAT to another media type formatted in FAT using a NTFS operating system is there an issue there? I'm really looking for some deep input here with information to back up the posts. Thank you.
-
NTFS has a little known 'feature' called Alternate Data Streams.
http://patriot.net/~carvdawg/docs/dark_side.html
I don't think using slack is viable anymore because NTFS uses a much smaller blocksize (ergo less slackspace).
-
Even though NTFS uses smaller clusters, most files will not fully use the clusters allocated to them. Parts of a file may survive even if it has been overwritten. If a file is very small then there may be enough space remaining in the MFT (each record is 1K) to store the whole file in the MFT itself. I would say there is still a minimal concern about slackspace. Fat to Fat transfer would retain all of the data within the clusters...how exactly are you "transferring" Fat data using NTFS?
-
SirDice,
I researched deeper in the the ADS situation and it looks like this is not an issue if you are removing the data from the NTFS format and transferring it to a form of media formatted as FAT.
Wazz,
Can you back up your statement with some information please.
Quote:
Originally posted here by Wazz
how exactly are you "transferring" Fat data using NTFS?
you can transfer data from a floppy formatted with FAT to a Zip disk formatted with FAT using Windows NT.
I found this resource for more information on ADS: Maresware: What Forensic Analysts should know about NT ALTERNATE DATA STREAMS (ADS)
-
Quote:
Originally posted here by Info Tech Geek
SirDice,
I researched deeper in the the ADS situation and it looks like this is not an issue if you are removing the data from the NTFS format and transferring it to a form of media formatted as FAT.
Correct. FAT doesn't have this feature so you'll lose the ADS when you copy a file from NTFS to FAT.
-
Is there anything else I should be conserned with. It kind of leaves an uneasy feeling when you can count on a feature to work without any if ands or buts on an MS system.
-
Quote:
Originally posted here by Info Tech Geek
It kind of leaves an uneasy feeling when you can count on a feature to work without any if ands or buts on an MS system.
Welcome to the wonderful world of MS Windows ;)
-
Ok, I miss understood...SirDice is correct. The way I understood it was "transferring information from a source of media formatted in FAT to another media type formatted in FAT using a NTFS operating system" as FAT to FAT. You meant NTFS to FAT judging by the other posts.