Mailing-List: contact cygwin-help AT sourceware DOT cygnus DOT com; run by ezmlm
List-Subscribe: <mailto:cygwin-subscribe AT sources DOT redhat DOT com>
List-Archive: <http://sources.redhat.com/ml/cygwin/>
List-Post: <mailto:cygwin AT sources DOT redhat DOT com>
List-Help: <mailto:cygwin-help AT sources DOT redhat DOT com>, <http://sources.redhat.com/ml/#faqs>
Sender: cygwin-owner AT sources DOT redhat DOT com
Delivered-To: mailing list cygwin AT sources DOT redhat DOT com
Content-return: allowed
Date: Mon, 14 May 2001 12:20:59 -0400
From: "Lamb, Ronald F." <RLamb AT wcom DOT net>
Subject: RE: colon got in file name -> can't delete!
To: cygwin AT cygwin DOT com
Message-id: <89AF232D6E74D411A5E70008C728978051F2B4@uuhil-354.inhouse.wcom.net>
MIME-version: 1.0
X-Mailer: Internet Mail Service (5.5.2653.19)
Content-type: text/plain; charset=iso-8859-1

FYI,

I didn't see this over the weekend, otherwise I would have
answered.  This is mentioned in a few MSDN Article, just do
a search on "NTFS" and "stream" on microsoft's web site. 
The most information is in the article
	"A Programmer's Perspective on NTFS 2000 Part 1: 
	Stream and Hard Link"

Did you try deleting the file using
	del .cachedmetrics

This happened because of a little known feature of the API
that allows multiple streams in a file.  It was in NT since
3.1, but not published until Windows 2000 came out.  It
seems to be used a lot internally by Microsoft, in
applications such as Word and Excel.  

	dir > multi:0

The following won't work
	type multi:0
	del multi:0

The following commands will
	notepad multi:0. 
	more < multi:0
	
You will see the following if you do a directory
	05/14/01	11:09a	0	multi

If you open multi, and enter some text in the file

You will now see the following under dir
	05/14/01	11:09a	121	mult

You can still open each stream individually, and read the
contents, however the only way to delete an is to delete
the entire file.
	del multi

*** WARNING ***
This can actually be very dangerous since it also messes up
the free disk space under most interfaces. In other words
depending on how many Word and Excel documents you have 
free disk space reporting may be really off.

In fact one article even mentions how this has been exploited
in some "geeky party games" by writing a large amount of
data to a stream and the person can't discover this because
the file shows as only occupying 0 bytes for all tools.  To
me this is a very bad thing.  I wonder how many viruses 
exploit this.

Ron

--
Want to unsubscribe from this list?
Check out: http://cygwin.com/ml/#unsubscribe-simple