Author Topic: Hiding Files in NTFS  (Read 9832 times)

0 Members and 2 Guests are viewing this topic.

Offline iago

  • Leader
  • Administrator
  • Hero Member
  • *****
  • Posts: 17914
  • Fnord.
    • View Profile
    • SkullSecurity
Hiding Files in NTFS
« on: October 14, 2004, 09:33:02 pm »
This is a really cool feature of NTFS that very few people know about.  Basically, you can hide any number of files (or "streams"), inside another file.  Open a command prompt, and go to your desktop (or where ever), do do the following:

Code: [Select]
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Ron> echo "This is an empty file, trust me!" > file.txt

C:\Documents and Settings\Ron> type C:\windows\system32\sol.exe > file.txt:hidden1.exe

C:\Documents and Settings\Ron> C:\windows\system32\winmine.exe > file.txt:hidden2.txt

C:\Documents and Settings\Ron> type C:\windows\system32\winmine.exe > file.txt:hidden2.exe

C:\Documents and Settings\Ron> start .\file.txt:hidden1.exe

C:\Documents and Settings\Ron> start .\file.txt:hidden2.exe

The "echo" simply creates an empty file.
The two "type" lines embed two different .exe's inside file.txt.  No matter what you do to file.txt, you'll never be able to see them.
The next two lines run the two different hidden programs. You can run these like this at any time.

Note that this _won't_ work across a network or if you put it in a zip or anything else, since this is a feature of ntfs.

Offline c0Ld

  • x86
  • Full Member
  • ***
  • Posts: 146
    • View Profile
Re: Hiding Files in NTFS
« Reply #1 on: October 14, 2004, 10:22:34 pm »
Yay, new way to hide my porn!

Offline Quik

  • Webmaster Guy
  • x86
  • Hero Member
  • *****
  • Posts: 3262
  • \x51 \x75 \x69 \x6B \x5B \x78 \x38 \x36 \x5D
    • View Profile
Re: Hiding Files in NTFS
« Reply #2 on: October 14, 2004, 10:35:21 pm »
haha that pwns, thx iago..
Quote
[20:21:13] xar: i was just thinking about the time iago came over here and we made this huge bomb and light up the sky for 6 min
[20:21:15] xar: that was funny

Offline Newby

  • x86
  • Hero Member
  • *****
  • Posts: 10877
  • Thrash!
    • View Profile
Re: Hiding Files in NTFS
« Reply #3 on: October 14, 2004, 11:14:46 pm »
That is hot. :)
- Newby
http://www.x86labs.org

Quote
[17:32:45] * xar sets mode: -oooooooooo algorithm ban chris cipher newby stdio TehUser tnarongi|away vursed warz
[17:32:54] * xar sets mode: +o newby
[17:32:58] <xar> new rule
[17:33:02] <xar> me and newby rule all

I'd bet that you're currently bloated like a water ballon on a hot summer's day.

That analogy doesn't even make sense.  Why would a water balloon be especially bloated on a hot summer's day? For your sake, I hope there wasn't too much logic testing on your LSAT. 

Offline Warrior

  • supreme mac daddy of trolls
  • Hero Member
  • *****
  • Posts: 7503
  • One for a Dime two for a Quarter!
    • View Profile
Re: Hiding Files in NTFS
« Reply #4 on: October 14, 2004, 11:25:58 pm »
What aboot FAT32  ???
One must ask oneself: "do I will trolling to become a universal law?" And then when one realizes "yes, I do will it to be such," one feels completely justified.
-- from Groundwork for the Metaphysics of Trolling

Offline Sidoh

  • x86
  • Hero Member
  • *****
  • Posts: 17634
  • MHNATY ~~~~~
    • View Profile
    • sidoh
Re: Hiding Files in NTFS
« Reply #5 on: October 15, 2004, 01:34:04 am »
What aboot FAT32  ???
Thats a silly question. :P

FAT32 is an old, outdated file system. IIRC, it doesn't even have security settings for different users! I doubt FAT32 could do this. :P

Offline iago

  • Leader
  • Administrator
  • Hero Member
  • *****
  • Posts: 17914
  • Fnord.
    • View Profile
    • SkullSecurity
Re: Hiding Files in NTFS
« Reply #6 on: October 15, 2004, 08:27:00 am »
No, this is an NTFS-specific feature.

It's actually used a little in Windows.  For example, thumbnails of images (I'm told) are stored in a seperate stream.  Also, right click on a text file, and go to the "Summary" tab -- that information is stored in seperate streams as well.

I'll post a program to find extra streams so you can find what else has it when I get to work.  I forget what the program is called, though.

Offline rabbit

  • x86
  • Hero Member
  • *****
  • Posts: 8092
  • I speak for the entire clan (except Joe)
    • View Profile
Re: Hiding Files in NTFS
« Reply #7 on: October 18, 2004, 11:00:30 pm »
So once you embed the file within the other file (say, a text file with a bunch of usernames & passwords into a blank text file) can you delete the original and just save/edit through start and then notepad, or what?

Offline iago

  • Leader
  • Administrator
  • Hero Member
  • *****
  • Posts: 17914
  • Fnord.
    • View Profile
    • SkullSecurity
Re: Hiding Files in NTFS
« Reply #8 on: October 19, 2004, 08:11:43 am »
I've never tried deleting the original, but I would imagine it woulnd't work.

Incidentally, you can also hide files in folders.

Offline Troop

  • Just Another Poster
  • Newbie
  • *
  • Posts: 22
  • Clan DW@USWest
    • View Profile
    • Zero Pulse Hosting
Re: Hiding Files in NTFS
« Reply #9 on: November 29, 2004, 06:40:30 pm »
Thanks iago, cool trick....
Within the perfect architecture of thought,
logic may often provide the structure
but from emotion comes the inspiration.
                                                 Troop - 2004

Offline deadly7

  • 42
  • x86
  • Hero Member
  • *****
  • Posts: 6496
    • View Profile
Re: Hiding Files in NTFS
« Reply #10 on: December 31, 2004, 08:48:27 pm »
* deadly7 :confuse:

I've never used NTFS before (go ahead laugh.. no need)
How would you open the hidden files?
Quote
C:\Documents and Settings\Ron> start .\file.txt:hidden1.exe

C:\Documents and Settings\Ron> start .\file.txt:hidden2.exe
Those two lines, but is that done in DOS/Command Prompt?

Also, you can change the file name to like... JPG or GIF right? (99% yes, but what the hell might as well ask)
[17:42:21.609] <Ergot> Kutsuju you're girlfrieds pussy must be a 403 error for you
 [17:42:25.585] <Ergot> FORBIDDEN

on IRC playing T&T++
<iago> He is unarmed
<Hitmen> he has no arms?!

on AIM with a drunk mythix:
(00:50:05) Mythix: Deadly
(00:50:11) Mythix: I'm going to fuck that red dot out of your head.
(00:50:15) Mythix: with my nine

Offline Quik

  • Webmaster Guy
  • x86
  • Hero Member
  • *****
  • Posts: 3262
  • \x51 \x75 \x69 \x6B \x5B \x78 \x38 \x36 \x5D
    • View Profile
Re: Hiding Files in NTFS
« Reply #11 on: December 31, 2004, 08:56:57 pm »
You're bumping old topics. And..

Quote
It's actually used a little in Windows.  For example, thumbnails of images (I'm told) are stored in a seperate stream.  Also, right click on a text file, and go to the "Summary" tab -- that information is stored in seperate streams as well.

I thought this was thumbs.db or whatever.
Quote
[20:21:13] xar: i was just thinking about the time iago came over here and we made this huge bomb and light up the sky for 6 min
[20:21:15] xar: that was funny

Offline deadly7

  • 42
  • x86
  • Hero Member
  • *****
  • Posts: 6496
    • View Profile
Re: Hiding Files in NTFS
« Reply #12 on: December 31, 2004, 08:58:46 pm »
I bumped this topic cause I didn't understand the last part, how to get the file OUT.
[17:42:21.609] <Ergot> Kutsuju you're girlfrieds pussy must be a 403 error for you
 [17:42:25.585] <Ergot> FORBIDDEN

on IRC playing T&T++
<iago> He is unarmed
<Hitmen> he has no arms?!

on AIM with a drunk mythix:
(00:50:05) Mythix: Deadly
(00:50:11) Mythix: I'm going to fuck that red dot out of your head.
(00:50:15) Mythix: with my nine

Offline iago

  • Leader
  • Administrator
  • Hero Member
  • *****
  • Posts: 17914
  • Fnord.
    • View Profile
    • SkullSecurity
Re: Hiding Files in NTFS
« Reply #13 on: January 01, 2005, 03:14:55 am »
I can't remember, go find an article on AFS :)

Incidentally, I read something that sounded to me like SP2 is using these to store information on downloaded files