About Sarah
Articles with the tag: File tunnelling
File tunnelling: weird creation timestamps
Sun, 25 Mar 2012 06:40PM
File tunnelling is a little known Windows capability that stems back from MSDOS days. In MSDOS, a ‘safe save’ was done by saving a copy of the modified data to a temp file, deleting the original and then renaming the temp file to the original name whilst also retaining the original files metadata. Windows NT also does this on FAT and NTFS to ensure that 16-bit applications can do a safe save, and this is called file tunnelling. This effects all Windows OSes including XP and Windows7.
Previous blog entries
Blog categories
- Forensics & science (7)
- Homemade arts & crafts (11)
- Rabbits (8)
- Programming (6)
- Miscellaneous (25)
- Recipes (5)
- Reviews (14)
- Digital Forensics & Malware (42)
- Trips & Visits (16)
- Cyber Security & Threat Management (12)
- IT & Computers (7)
- HCI & Design (6)
Blog tags
microsoft edge sock puppets O2 Cyber Academy ISACA kill chain Barcelona Ben Nevis PostgreSQL Lake Como File tunnelling Data Protection Act self deletion draught excluder Internet Explorer Sainsbury's résumé government CV counting open source MP3 sharing foamcore Mosaic symposium favicon ADS cake timezones nudge theory compSIA. Security+ papier mache link files Safari exhibition iPod touch Opera Chilli file headers sausages Mini forensics challenge The Balmoral GDPR England metaphors public lecture Windows 7 guidelines Edinburgh file directories confirmation bias Itiel Dror cloud passwords reference management insider fraud wifi threat assessment forensics evaluation
