Results 1 to 8 of 8

Thread: Data Security

  1. #1
    Senior Member Info Tech Geek's Avatar
    Join Date
    Jan 2003
    Location
    Vernon, CT
    Posts
    828

    Data Security

    In the days of 9x there were so many utilities that were released to perform a secure copy excluding all the data that would be transfered in the slack space of a file. Now in the days of NT/2K/XP/2K3 there is less and less call for a secure copy or the exclusion of any data that may be transferred unaware by a copy. Is this no longer a concern with the NTFS file system or is there something many people are over looking? Also, if you are transferring information from a source of media formatted in FAT to another media type formatted in FAT using a NTFS operating system is there an issue there? I'm really looking for some deep input here with information to back up the posts. Thank you.

  2. #2
    Just Another Geek
    Join Date
    Jul 2002
    Location
    Rotterdam, Netherlands
    Posts
    3,401
    NTFS has a little known 'feature' called Alternate Data Streams.

    http://patriot.net/~carvdawg/docs/dark_side.html

    I don't think using slack is viable anymore because NTFS uses a much smaller blocksize (ergo less slackspace).
    Oliver's Law:
    Experience is something you don't get until just after you need it.

  3. #3
    Senior Member Wazz's Avatar
    Join Date
    Apr 2003
    Posts
    288
    Even though NTFS uses smaller clusters, most files will not fully use the clusters allocated to them. Parts of a file may survive even if it has been overwritten. If a file is very small then there may be enough space remaining in the MFT (each record is 1K) to store the whole file in the MFT itself. I would say there is still a minimal concern about slackspace. Fat to Fat transfer would retain all of the data within the clusters...how exactly are you "transferring" Fat data using NTFS?
    "It is a shame that stupidity is not painful" - Anton LaVey

  4. #4
    Senior Member Info Tech Geek's Avatar
    Join Date
    Jan 2003
    Location
    Vernon, CT
    Posts
    828
    SirDice,
    I researched deeper in the the ADS situation and it looks like this is not an issue if you are removing the data from the NTFS format and transferring it to a form of media formatted as FAT.

    Wazz,
    Can you back up your statement with some information please.
    Originally posted here by Wazz
    how exactly are you "transferring" Fat data using NTFS?
    you can transfer data from a floppy formatted with FAT to a Zip disk formatted with FAT using Windows NT.

    I found this resource for more information on ADS: Maresware: What Forensic Analysts should know about NT ALTERNATE DATA STREAMS (ADS)

  5. #5
    Just Another Geek
    Join Date
    Jul 2002
    Location
    Rotterdam, Netherlands
    Posts
    3,401
    Originally posted here by Info Tech Geek
    SirDice,
    I researched deeper in the the ADS situation and it looks like this is not an issue if you are removing the data from the NTFS format and transferring it to a form of media formatted as FAT.
    Correct. FAT doesn't have this feature so you'll lose the ADS when you copy a file from NTFS to FAT.
    Oliver's Law:
    Experience is something you don't get until just after you need it.

  6. #6
    Senior Member Info Tech Geek's Avatar
    Join Date
    Jan 2003
    Location
    Vernon, CT
    Posts
    828
    Is there anything else I should be conserned with. It kind of leaves an uneasy feeling when you can count on a feature to work without any if ands or buts on an MS system.

  7. #7
    Just Another Geek
    Join Date
    Jul 2002
    Location
    Rotterdam, Netherlands
    Posts
    3,401
    Originally posted here by Info Tech Geek
    It kind of leaves an uneasy feeling when you can count on a feature to work without any if ands or buts on an MS system.
    Welcome to the wonderful world of MS Windows
    Oliver's Law:
    Experience is something you don't get until just after you need it.

  8. #8
    Senior Member Wazz's Avatar
    Join Date
    Apr 2003
    Posts
    288
    Ok, I miss understood...SirDice is correct. The way I understood it was "transferring information from a source of media formatted in FAT to another media type formatted in FAT using a NTFS operating system" as FAT to FAT. You meant NTFS to FAT judging by the other posts.
    "It is a shame that stupidity is not painful" - Anton LaVey

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •