Mail Archives: cygwin/2001/05/14/12:40:09
FYI,
I didn't see this over the weekend, otherwise I would have
answered. This is mentioned in a few MSDN Article, just do
a search on "NTFS" and "stream" on microsoft's web site.
The most information is in the article
"A Programmer's Perspective on NTFS 2000 Part 1:
Stream and Hard Link"
Did you try deleting the file using
del .cachedmetrics
This happened because of a little known feature of the API
that allows multiple streams in a file. It was in NT since
3.1, but not published until Windows 2000 came out. It
seems to be used a lot internally by Microsoft, in
applications such as Word and Excel.
dir > multi:0
The following won't work
type multi:0
del multi:0
The following commands will
notepad multi:0.
more < multi:0
You will see the following if you do a directory
05/14/01 11:09a 0 multi
If you open multi, and enter some text in the file
You will now see the following under dir
05/14/01 11:09a 121 mult
You can still open each stream individually, and read the
contents, however the only way to delete an is to delete
the entire file.
del multi
*** WARNING ***
This can actually be very dangerous since it also messes up
the free disk space under most interfaces. In other words
depending on how many Word and Excel documents you have
free disk space reporting may be really off.
In fact one article even mentions how this has been exploited
in some "geeky party games" by writing a large amount of
data to a stream and the person can't discover this because
the file shows as only occupying 0 bytes for all tools. To
me this is a very bad thing. I wonder how many viruses
exploit this.
Ron
--
Want to unsubscribe from this list?
Check out: http://cygwin.com/ml/#unsubscribe-simple
- Raw text -