Re: [Linux-NTFS-Dev] hidden files?

[Richard R. <ri...@fl...>]

Hi Morten,

> I am trying to recover some files from an xp machine, and It works nicely. I
> use the trinux boot disk and smbmount a share to copy every onto.

Hmm, "trying", "recover", linux.

> The problem is that I apparently haven't copied everything.
> A quick search on the net revealed the concept of alternate data streams

OK, you are correct.  The Linux NTFS driver doesn't allow you to read
the other (named) data streams.

> My question is whether ntfs have these very hidden files or directories.

Yes NTFS has them, but fortunately, they aren't used often.  The only
common example I know of is to store summary information for files,
etc.  I don't think anyone would _rely_ on that information, though,
because it's so easily lost.  If you copy the file to a FAT partition,
e.g. a floppy.

I don't know if named data streams are preserved over windows file
sharing (between two windows machines).

> Supposed to be a huge security hole.

Hmm, I don't know about that.

> And how to access them.

I don't actually know how you list the data streams of a file (other
than reading the disk with a hex editor).

I hope this answers your questions,
  FlatCap (Rich)
  ri...@fl...