About Sarah
Articles with the tag: Windows
File tunnelling: weird creation timestamps
Sun, 25 Mar 2012 06:40PM
File tunnelling is a little known Windows capability that stems back from MSDOS days. In MSDOS, a ‘safe save’ was done by saving a copy of the modified data to a temp file, deleting the original and then renaming the temp file to the original name whilst also retaining the original files metadata. Windows NT also does this on FAT and NTFS to ensure that 16-bit applications can do a safe save, and this is called file tunnelling. This effects all Windows OSes including XP and Windows7.
Previous blog entries
Blog categories
- Forensics & science (7)
- Homemade arts & crafts (11)
- Rabbits (8)
- Programming (6)
- Miscellaneous (25)
- Recipes (5)
- Reviews (14)
- Digital Forensics & Malware (42)
- Trips & Visits (16)
- Cyber Security & Threat Management (12)
- IT & Computers (7)
- HCI & Design (6)
Blog tags
General Election facts Firebug coasters link files conference search nudge theory tea Registry Routine Activities Theory Opera Humyo Irari rules intelligence altitude sickness Firefox steganography search terms data privacy Barranco camp File tunnelling iPod touch government Lenzie threat assessment gig Lake Como captcha visualisation paintings crime scene backup promotion Strathclyde guidelines CSS Myxomatosis mobile phones Mweke case management Etsy stew East Lothian St Nicholas Michelin restaurant snob papier mache beach asparagus SMS Derren Brown binky statistics digital forensics file directories recycle bin Data Protection Act symposium reference management
