Decoding Norton "NPROTECT.LOG"

From: Mark G. Spencer (dreadnoughtat_private)
Date: Tue Nov 05 2002 - 13:35:36 PST

  • Next message: Seth Arnold: "Re: Win32 Port of TAR"

    Has anyone decoded the Norton Protected Recycle Bin "NPROTECT.LOG" file?
    
    
    On a Win2K machine I have thousands of files in a /Recycler/NPROTECT
    folder.  It looks like Norton left the file extensions alone of the
    files in this folder (they are of various common types), but the
    filenames are all numerals and start with "000".  The only file in this
    folder which deviates from this convention is the "NPROTECT.LOG" which
    appears to be the index which correlates the "000" filenames with the
    original filenames and paths.  I'm hoping this file also has the
    deletion date and time stamps, and maybe more useful information.
    
    It doesn't seem the structure of this file is documented anywhere
    however, and Symantec has not yet been of assistance.  Normally you
    would just boot a machine up and run the application to access these
    "Norton Protected" files, but that is not an option here.
    
    Also, thanks for all the great responses regarding the CD-ROM date and
    time stamping!  I should have a summary together soon on both UDF and
    ISO.
    
    Mark
    
    ---------------------------------------------
    Introducing NetZero Long Distance
    1st month Free!
    Sign up today at: www.netzerolongdistance.com
    
    -----------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Fri Nov 08 2002 - 22:12:41 PST