Re: Hidden files on NTFS

From: Kurt Seifried (bugtraqat_private)
Date: Mon Sep 16 2002 - 19:53:40 PDT

Next message: forensicstoolsat_private: "Computer Forensics Tools Focus Group"

Previous message: InternetSmiths: "try a chkdsk /f Re: Hidden files on NTFS"
In reply to: brian levasseur: "Hidden files on NTFS"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

> I have a 2K sever that I am unable to account for
> several Gigs of used hard drive space.  I have used
> several ADS and hidden files tools to no avail.  Are
> there other ways to hide large amounts of data on
> NTFS?  Also, I am pretty sure this box is compromised.
>  It has every service known to man running on it (not
> just 2K services).  Any help is greatly appreciated.

master file table is always fun.  Alternate data streams are a classic, but
you say you have checked. Also make sure you have rights/ownership to all
the files/directories, i.e. admin may have been "locked out" of a given
directory/etc where a lot of files are hiding.


Kurt Seifried, kurtat_private
A15B BEE5 B391 B9AD B0EF
AEB0 AD63 0B4E AD56 E574
http://seifried.org/security/





-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: forensicstoolsat_private: "Computer Forensics Tools Focus Group"
Previous message: InternetSmiths: "try a chkdsk /f Re: Hidden files on NTFS"
In reply to: brian levasseur: "Hidden files on NTFS"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Wed Sep 18 2002 - 05:54:11 PDT