Re: Win2K/NTFS messes file creation time/date

From: Justin Nelson (securityat_private)
Date: Sun Jul 15 2001 - 21:59:32 PDT

  • Next message: joshat_private: "2.4.x/Slackware Init script vulnerability"

    Hello,
    
    > I accidently stumbled accross this error when I made a program of mine
    > create 3 text files containing different debug output.
    ...
    > When I ran my program the very first time it created the 3 text files and
    > set all of the 3 values properly as the should.
    > After viewing the files I deleted them (Shift + Del) by hand and reran the
    > program.
    > Again the 3 files were created, but the Creation time/date was set wrong,
    > namely it was set to the very first creation time ( before I deleted them
    > by hand ).
    
    I believe this is "normal" behavior under Windows. I think it has something
    to do with the filesystem cache, but I'm not sure. I've seen this happen
    under Windows 98 as well as 2000 (both running FAT32).
    
    In any case, while it may be a bug, I don't think this would present any
    kind of security problem.
    
    I did once have an issue under Win98 where if a file was deleted, then
    immediately opened for writing, the previous contents would be resurrected
    (if not written over by the new writes). This was on a system where the
    Recycle-bin had been disabled.
    
    I'm not sure if the two issues are somehow related, but in my mind both seem
    to point to the filesystem cache. It may just be poor design rather than a
    bug (a "feature"?)
    
    - Justin
    



    This archive was generated by hypermail 2b30 : Mon Jul 16 2001 - 08:54:05 PDT