NTFS File Masking
Submitted:|| 20th June, 2005
THIS PRINCIPLE IS TO BE USED WITH CAUTION.
This only works on hard drives formatted with NTFS.
What do we want?
We want stealth. Ever found it annoying to keep having to secure and encrypt your gamesaves? Ever found it a pain trying to hide core game files so they don't get stolen (such as MP3 files), whilst knowing that the 'hidden' attribute is easy to get around?
Imagine if there was a way to hide a file *completely*.
Suppose we could hide one file behind another - but in a way that didn't alter its contents or size at all?
Suppose we could make a file *totally* invisible?
Well if your hard drive uses NTFS format, you can. And it's deliciously simple too!
How can we do it?
What we're going to do is exploit something called ADS. It stands for Alternate Data Stream.
In previous formats, like FAT and FAT32, it used the following system to arrange files:
What ADS does is let you use a colon ( : ) to define a second file, to sit next to the first. So if we made a file here:
we could hide another file behind it by saving it here:
See? Amazingly, you can do this from within such extensions as The Edit Object, and even Binary Object.
Now if we look at c:\folder\, what do we see?
The only visible file is fred.txt.
Nothing else. If we open fred.txt, its contents have not changed. Even its file length in bytes hasn't changed.
To bring myOtherFile.txt back, we simply open it with the same commandline that we saved it with:
It's one thing to hide a file behind another. But imagine if we could make a file *totally* invisible!
Well try saving a file like this:
There's no filename to attach it to, we just start straight off with the colon. This is a file that's hidden in the Alternate Data Stream, but it's not attached to a file in the normal Data Stream (the files we see in Windows).
If we go to c:\folder\, this file is totally invisible. There's no evidence of its existence anywhere.
The WARNING bit
Remember I told you to put all the ADS files in a new folder? Well this is why.
Because Windows isn't really sure what to do with ADS, only some of the Windows features work on ADS files. 'Delete' is not one of them.
Pretty much the only way to delete an ADS file once you've made it is to delete the file you attached it to. Or, you can copy the file to a non-NTFS drive (like a FAT32 disk), which will automatically strip off the ADS data.
When our file is hidden without another to hold onto, it's totally immune to delete. The only way to remove it is to delete the folder it lives in.
In this case, the only way to delete 'invisible.txt' would be to delete the whole 'Folder' directory.
If you're going to use ADS in a program, make sure all the NTFS stuff is done inside a specific folder. Then if the worst comes to the worst, you can remove that folder and all the ADS work you did will be gone.
Pitfalls and Problems
This obviously isn't perfect. Since ADS only really works with NTFS drives, a drive not formatted with NTFS won't let you use ADS. You may also experience trouble with copying these files into zip files, or onto the internet. I haven't tested these things.
For these reasons, don't depend on the ADS files too much.
A simple check
One easy way to check if a drive can support ADS is to do this:
Create a frame with an edit object in it.
Save a file somewhere on this disk, like this:
then set the value of the edit object to something like 'OK' and save it as:
Then set the value of the edit object to (blank).
Now try loading the file again:
If the text box again reads 'OK', you know it's worked. If it doesn't, then ADS isn't supported.
This can also be used to test extensions to see if they work with ADS.
Hiding your game saves is one. You may choose to make a file hider system to keep your documents from prying eyes.
Enjoy. I hope this helps you keep your gamesaves a bit more secure!
Best Article WriterRegistered