-
January 6th, 2004, 03:38 PM
#1
Data Security
In the days of 9x there were so many utilities that were released to perform a secure copy excluding all the data that would be transfered in the slack space of a file. Now in the days of NT/2K/XP/2K3 there is less and less call for a secure copy or the exclusion of any data that may be transferred unaware by a copy. Is this no longer a concern with the NTFS file system or is there something many people are over looking? Also, if you are transferring information from a source of media formatted in FAT to another media type formatted in FAT using a NTFS operating system is there an issue there? I'm really looking for some deep input here with information to back up the posts. Thank you.
-
January 6th, 2004, 03:44 PM
#2
NTFS has a little known 'feature' called Alternate Data Streams.
http://patriot.net/~carvdawg/docs/dark_side.html
I don't think using slack is viable anymore because NTFS uses a much smaller blocksize (ergo less slackspace).
Oliver's Law:
Experience is something you don't get until just after you need it.
-
January 6th, 2004, 04:20 PM
#3
Even though NTFS uses smaller clusters, most files will not fully use the clusters allocated to them. Parts of a file may survive even if it has been overwritten. If a file is very small then there may be enough space remaining in the MFT (each record is 1K) to store the whole file in the MFT itself. I would say there is still a minimal concern about slackspace. Fat to Fat transfer would retain all of the data within the clusters...how exactly are you "transferring" Fat data using NTFS?
"It is a shame that stupidity is not painful" - Anton LaVey
-
January 6th, 2004, 04:26 PM
#4
SirDice,
I researched deeper in the the ADS situation and it looks like this is not an issue if you are removing the data from the NTFS format and transferring it to a form of media formatted as FAT.
Wazz,
Can you back up your statement with some information please.
Originally posted here by Wazz
how exactly are you "transferring" Fat data using NTFS?
you can transfer data from a floppy formatted with FAT to a Zip disk formatted with FAT using Windows NT.
I found this resource for more information on ADS: Maresware: What Forensic Analysts should know about NT ALTERNATE DATA STREAMS (ADS)
-
January 7th, 2004, 09:54 AM
#5
Originally posted here by Info Tech Geek
SirDice,
I researched deeper in the the ADS situation and it looks like this is not an issue if you are removing the data from the NTFS format and transferring it to a form of media formatted as FAT.
Correct. FAT doesn't have this feature so you'll lose the ADS when you copy a file from NTFS to FAT.
Oliver's Law:
Experience is something you don't get until just after you need it.
-
January 7th, 2004, 03:55 PM
#6
Is there anything else I should be conserned with. It kind of leaves an uneasy feeling when you can count on a feature to work without any if ands or buts on an MS system.
-
January 7th, 2004, 04:43 PM
#7
Originally posted here by Info Tech Geek
It kind of leaves an uneasy feeling when you can count on a feature to work without any if ands or buts on an MS system.
Welcome to the wonderful world of MS Windows
Oliver's Law:
Experience is something you don't get until just after you need it.
-
January 8th, 2004, 03:29 AM
#8
Ok, I miss understood...SirDice is correct. The way I understood it was "transferring information from a source of media formatted in FAT to another media type formatted in FAT using a NTFS operating system" as FAT to FAT. You meant NTFS to FAT judging by the other posts.
"It is a shame that stupidity is not painful" - Anton LaVey
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|