- [Host] Window systems usually boot from,
and use a disc with the NTFS file system.
And when they do, they store their file system metadata
in a structure called an MFT, or master file table.
This data structure keeps track of the names of files
and where their data is stored on the disc.
It also keeps track of the basic and extended attributes
we can attach to the files.
In addition to some more specialized metadata.
This data structure
allows us to add alternate data streams to files as well.
Like other file systems,
NTFS stores standard information like file names,
and various file modification dates.
We can see some of this basic information
in the Explorer properties pin.
Which we can get to by right clicking a file,
and choosing properties.
Here's the name, the size and a few dates.
We can find a bit more information over on the details tab,
including some of its attributes.
We'll explore attributes more in just a moment.
We can also find information using PowerShell.
Here in my PowerShell terminal,
I've navigated to the directory where my files are stored
and I'll type, "Get dash item property,"
the name of the file,
and I'll pipe that into format list.
And here we can see the creation time
and we can also see the last write time
and the last access time.
The most recent times when the file was modified and read.
Depending on the type of file we're looking at,
we may see other metadata as well
in this properties window.
Using graphical tools,
we can set access parameters for the file;
to determine which of the users have which level of access.
This access control list
can be set by users on files they own
and can be set universally by the administrator.
We can also view these from the PowerShell terminal as well.
With the command, "Get dash ACL," the file name,
and then again I'll pipe this to format list.
And here I can see this file's ACL.
There are also PowerShell commands to modify these ACL's,
should we need to do that.
But, this course isn't about determining
and designing access control.
So, take a look at our courses on Windows administration
for more detail on that topic.
Files on a window system can have a variety of attributes
that control how they work.
Among these, are "read only," "hidden," and "archive."
In the PowerShell terminal,
We can run the command, "attrib slash question mark,"
to see how to use this command
and what the available attributes are.
Let's use the "hidden" attribute to practice here.
I'll write, "attrib plus capital H, market photo dot jpeg"
With "plus H," to add the "H,"
or "hidden" attribute to this file.
Before I run that,
watch over here on the right side in the Explorer.
I'll run the command, and there goes the file.
It's hidden from view.
And when I list the files in this directory,
it doesn't show up here either.
I can tell Explorer to show hidden files
with this option here.
And I can use the command,
"dir dash capital F O,"
or a handful of other similar commands
like the PowerShell command,
"get child item dash force," to see all the files.
Here's my hidden file.
And notice that it has an "H" here in its mode string.
While all the others just have "A" for archive.
This file will also be hidden,
as long as it stays stored on a file system
that supports this attribute.
But, the attribute will be stripped
if I copy this to a file system
that doesn't support attributes, like X-fat.
We can un-hide the file with,
"attrib minus capital H."
And now it's back.
Windows supports alternate data streams,
which provide a way to attach additional data to a file.
Some software, like web browsers,
will stick an alternate data stream
onto downloaded files to indicate their origin URL.
And alternate data streams have other uses as well.
Here in the PowerShell terminal,
let's attach a small amount of text to a file
and give that value a name.
I'll write, "set dash content,"
provide the name of my file,
and then I'll type a colon,
and I'll follow that colon with a key.
For this key, I'll set the value,
"this is my custom value."
Next, I'll run get item
on all the files here in my directory.
Even though I've added a value to this file,
there's no indication of it here.
This is only showing the data streams.
To see my custom data stream,
I'll write, "get dash item,"
provide the file name,
and then tell PowerShell
to show me all the streams for this file.
The first one here is the data stream.
That's the actual file.
And down here is the stream called, "My Data."
This is the data that I attach to the file.
To see what's in that stream,
I can run get content,
provide the file name, type a colon,
and then use the key that I set earlier, "My Data."
And there's the value that I set for this key.
We can use the "remove item" command to erase an entry,
and there are some other more specific commands
for working with these values too.
Take a look at the "help" for "get content,"
or "get item" to learn a bit more.
Earlier, I mentioned that browsers often set an ADS.
So, let's take a look at a downloaded file.
I'll switch over to my downloads directory,
and I'll clear the screen.
Earlier I downloaded "exit tool."
So, let's take a look at that file.
I'll write "get item," provide a file name.
And let's take a look at all of the streams.
As we'd expect, here's a data stream,
and here's an ADS called, "zone dot identifier."
Let's see what that is.
I'll write, "get content," provide the file name,
type a colon, and then I'll use the key,
"zone dot identifier."
And I can see the URL this file was downloaded from.
Neat.
So, you can see how alternate data streams
would be useful for tagging files
with custom information.
We could copy a whole program, even a malicious one,
into an alternate data stream
of an otherwise innocent program.
Hiding it from casual investigation,
but still allowing us to run it if we know where to look.
Malware scanners are aware of this trick though,
and can find hidden malware in alternate streams.
Because we can attach any data to a file,
and because some metadata gets added to files
by other software.
Alternate data streams
can present a risk of information oversharing,
or other security problems.
Alternate data streams exist only by that name on Windows.
And on other platforms,
we'll see similar metadata structures
referred to as, "extended attributes."
As long as we keep files on file systems
with support for these values;
our data streams, or extended attributes
can transfer between platforms.
But, if we try to copy a file to a file system
that doesn't support them.
Like X-fat, fat 32, or plain old, fat.
We'll see a warning that these extra streams
will be dropped.
That may be fine with us
if we only want to copy the actual file data
and don't care about the metadata.
But, if we need to preserve that data,
we'll need to find an NTFS disc to copy it onto.
When we customize the view settings
of a Windows folder,
those changes are stored in the folder
in a file called Desktop.ini.
So, the changes persist both on our system,
and on other Windows systems
where we might use the folder.
This file doesn't store a large amount of information,
but it can tell us a little bit.
Like what the custom icon or image for a folder is,
and so on.
Another file type that could reveal some information,
is Thumbs.db.
A file generated by older versions of Windows,
when viewing media in a thumbnail view.
This file contains small images
that represent the media files in the directory.
If we delete an image in a directory on Windows,
the thumbnails file should eventually be updated.
But, if we have a copy of this file
and the associated images on another platform,
and we delete one or more images there;
the thumbs file won't be updated.
And so a small copy of a deleted image can persist.
These images can be extracted from the file
in low resolution.
And thus can reveal some information
about what is in a folder,
or what has been in a folder.
While the Desktop.ini, and Thumbs.db files
aren't strictly file system metadata.
They both serve to store some information about files,
outside of the file data itself.
And because they can contain information about files,
they can present a security risk.
Windows in conjunction with the NTFS file system
offers many different file system metadata values
that are used across the system and by users.
NTFS can accommodate metadata values
from other platforms too.
Making it a suitable backend for a file sharing system.
As we'll see when working with other file systems,
many of the metadata types that we've explored here
are represented on Linux and Mac Os file systems.
Their names vary a bit though,
and not all platforms
can write to all of these file systems directly.