NTFS Archives • Helge Klein

Finding (Executables in) User-Writeable Directories

This article presents two different detection types for insecure filesystem permissions on Windows endpoints: scanning for directories that are user-writable, and detecting processes that are started from user-writeable directories.

What is the SYNCHRONIZE File Access Right?

When dealing with Windows NTFS file system permissions, one quickly encounters the SYNCHRONIZE access right, the purpose of which may not be obvious. SYNCHRONIZE belongs to the standard access rights, just like DELETE, READ_CONTROL, WRITE_DAC and WRITE_OWNER. Here is the definition of SYNCHRONIZE from MSDN (2010): The SYNCHRONIZE access right is defined within the standard […]

Hard Links, Soft (Symbolic) Links and Junctions in NTFS: What Are They (For)?

This is an attempt at demystification. In the Windows world, links in the file system are often regarded as obscure, except for the infamous .LNK files, of course. But file system links are neither freaky UNIX/Linux command line stuff, nor are they new: Microsoft’s OS offers two types of links since Windows 2000 and a […]

Why Disabling the Creation of 8.3 DOS File Names Will Not Improve Performance. Or Will It?

It is a common practice amongst administrators to disable the creation of short filenames on NTFS. I freely admit to have recommended this in the past. Was I wrong? Background NTFS is relatively relaxed about file names. They can be quite long (255 characters) and may contain “strange” characters (nearly all UNICODE characters are allowed).

Tag: NTFS

Finding (Executables in) User-Writeable Directories

What is the SYNCHRONIZE File Access Right?

Hard Links, Soft (Symbolic) Links and Junctions in NTFS: What Are They (For)?

Why Disabling the Creation of 8.3 DOS File Names Will Not Improve Performance. Or Will It?