About Sarah
Articles with the tag: timestamps
File tunnelling: weird creation timestamps
Sun, 25 Mar 2012 06:40PM
File tunnelling is a little known Windows capability that stems back from MSDOS days. In MSDOS, a ‘safe save’ was done by saving a copy of the modified data to a temp file, deleting the original and then renaming the temp file to the original name whilst also retaining the original files metadata. Windows NT also does this on FAT and NTFS to ensure that 16-bit applications can do a safe save, and this is called file tunnelling. This effects all Windows OSes including XP and Windows7.
Previous blog entries
Blog categories
- Forensics & science (7)
- Homemade arts & crafts (11)
- Rabbits (8)
- Programming (6)
- Miscellaneous (25)
- Recipes (5)
- Reviews (14)
- Digital Forensics & Malware (42)
- Trips & Visits (16)
- Cyber Security & Threat Management (12)
- IT & Computers (7)
- HCI & Design (6)
Blog tags
News of the World AJAX cases nudge theory Sainsbury's Pentlands polaroid censorship Cyber Academy Malware heatmap court report cree.py Safari security thumbs.db chocolate ADS internet history free courses forensics Brigitte Reusch shoes snob Derren Brown SQLAlchemy cloud Barafu foodies chain of custody asparagus rabbit nutrition alternate data streams exam arts fair Lockheed Martin magnets mentoring readability iPod touch JavaScript Routine Activities Theory Data Protection Act ACPO malware analysis moving flat Gullane Mosaic counting promotion statistics Hayes commands Michelin restaurant Moo demographics restaurant Irari rules file directories canvas answers
