Re: Debian creates duplicate image files with strange extensions!

• Previous message: Henrique de Moraes Holschuh: "Removal of old cyrus-sasl (libsasl7) from sarge"
• In reply to: Siju George: "Re: Debian creates duplicate image files with strange extensions!"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Date: Sat, 06 Nov 2004 08:49:55 -0800
To: Debian-User <debian-user@lists.debian.org>

Siju George wrote:

>Hi Ron,
>
>Thanks a lot for the Reply
>
>On Sat, 06 Nov 2004 08:04:18 -0600, Ron Johnson <ron.l.johnson@cox.net> wrote:
>
>
>
>>Are you so sure that *Debian* does this, and *should* be fixed?
>>
>>
>>
>No Idea Ron! but because of that I am not able to copy the folder
>through windows to take backup!
>
>I get the error saying that the specified resource does not exist
>
>Thankyou somuch
>
>Kind regards
>
>Siju
>
>
>
>
What those file names look like to me are something that Microsoft uses
with NTFS called ADS (Alternate Data Streams). Do a Google search for
lads.exe and ADS. Download and install lads. Then run lads on the
contents of an NTFS folder. (It is a command line tool so you will have
to place it in your system path.) When you run it you will find file
names very much like the ones you listed here. Why they are showing up
in Samba I don't know. What file system are you using with Samba
directories? That may have something to do with it. LInux may see
these files and make them visible where the Microsoft kernel won't do
that.

ADS is used intermittently (some files have it others don't) by Win2K,
and I would imagine, XP and I have often found the ADS files used with
the file extensions that you listed.

ADS files take up no space on an NTFS file system. I know it's hard to
believe, but you can create a 100 mb text file, hide it using ADS and
you won't find an increase in the space used on your hard disk.

ADS is something that some crackers use to hide things on compromised
systems and the only way to find them is through the use of lads.exe and
streams.exe. I have found lads.exe to be much more stable than
streams.exe as streams will sometimes hang or crash if its log file gets
too large. I've never run into that with lads.exe even with log files
of a few hundred megabtyes.

-- 
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org 
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

• Previous message: Henrique de Moraes Holschuh: "Removal of old cyrus-sasl (libsasl7) from sarge"
• In reply to: Siju George: "Re: Debian creates duplicate image files with strange extensions!"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]