New Technology File System (NTFS) - Revision history

Joachim Metz: /* External links */

2012-09-30T13:05:53Z

‎External links

2012-09-14T12:19:31Z

‎External links

2012-07-31T08:27:08Z

2012-07-31T08:20:25Z

2012-03-16T06:09:44Z

spelling correction for "Windows NTFS Metadata Extactor Utility"

2012-03-15T23:06:01Z

Tidying up the link.

2012-03-15T23:03:45Z

Adding link to linux-ntfs NTFS documentation.

2011-06-16T00:22:37Z

‎Alternate Data Streams

2011-01-01T22:45:38Z

‎External links

2010-11-12T07:46:09Z

@@ Line 47: / Line 47: @@
 * [http://sourceforge.net/projects/linux-ntfs/files/NTFS%20Documentation/ Linux-ntfs Documentation] Detailed documentation of the NTFS format by the Linux-NTFS driver creators.
 * [http://support.microsoft.com/kb/140365 Default cluster size for NTFS, FAT, and exFAT]
 [[Category:File Systems]]

@@ Line 46: / Line 46: @@
 * [http://www.tzworks.net/prototype_page.php?proto_id=12  Windows NTFS Metadata Extractor Utility] Free tool that can be run on Windows, Linux or Mac OS-X
 * [http://sourceforge.net/projects/linux-ntfs/files/NTFS%20Documentation/ Linux-ntfs Documentation] Detailed documentation of the NTFS format by the Linux-NTFS driver creators.
 [[Category:File Systems]]

← Older revision		Revision as of 08:20, 31 July 2012
Line 47:		Line 47:
	* [http://sourceforge.net/projects/linux-ntfs/files/NTFS%20Documentation/ Linux-ntfs Documentation] Detailed documentation of the NTFS format by the Linux-NTFS driver creators.		* [http://sourceforge.net/projects/linux-ntfs/files/NTFS%20Documentation/ Linux-ntfs Documentation] Detailed documentation of the NTFS format by the Linux-NTFS driver creators.

−	[[Category:~~Disk file systems~~]]	+	[[Category:File Systems]]

@@ Line 44: / Line 44: @@
 * [http://msdn.microsoft.com/en-us/library/bb968806%28v=VS.85%29.aspx MSDN on Transactional NTFS]
 * [http://en.wikipedia.org/wiki/Transactional_NTFS Wikipedia on Transactional NTFS]
-* [http://www.tzworks.net/prototype_page.php?proto_id=12  Windows NTFS Metadata Extactor Utility] Free tool that can be run on Windows, Linux or Mac OS-X
+* [http://www.tzworks.net/prototype_page.php?proto_id=12  Windows NTFS Metadata Extractor Utility] Free tool that can be run on Windows, Linux or Mac OS-X
 * [http://sourceforge.net/projects/linux-ntfs/files/NTFS%20Documentation/ Linux-ntfs Documentation] Detailed documentation of the NTFS format by the Linux-NTFS driver creators.
 [[Category:Disk file systems]]

@@ Line 45: / Line 45: @@
 * [http://en.wikipedia.org/wiki/Transactional_NTFS Wikipedia on Transactional NTFS]
 * [http://www.tzworks.net/prototype_page.php?proto_id=12  Windows NTFS Metadata Extactor Utility] Free tool that can be run on Windows, Linux or Mac OS-X
-* [http://sourceforge.net/projects/linux-ntfs/files/NTFS%20Documentation/] Detailed documentation of the NTFS format by the Linux-NTFS driver creators.
+* [http://sourceforge.net/projects/linux-ntfs/files/NTFS%20Documentation/ Linux-ntfs Documentation] Detailed documentation of the NTFS format by the Linux-NTFS driver creators.
 [[Category:Disk file systems]]

← Older revision		Revision as of 00:22, 16 June 2011
Line 24:		Line 24:

	Sysadmins should be aware that prior to Vista, there are no tools native to the [[Windows]] platform that would allow you to view the existence of arbitrary ADSs. While ADSs can be created and their contents executed or viewed, it wasn't until the "/r" switch was introduced with the "dir" command on Vista that arbitrary ADSs would be visible. Prior to this, tools such as [http://www.heysoft.de/Frames/f_sw_la_en.htm LADS] could be used to view the existence of these files.		Sysadmins should be aware that prior to Vista, there are no tools native to the [[Windows]] platform that would allow you to view the existence of arbitrary ADSs. While ADSs can be created and their contents executed or viewed, it wasn't until the "/r" switch was introduced with the "dir" command on Vista that arbitrary ADSs would be visible. Prior to this, tools such as [http://www.heysoft.de/Frames/f_sw_la_en.htm LADS] could be used to view the existence of these files.
		+
		+	Microsoft FSRM (File System Resource Manager) also uses ADS as part of 'file classification'.

	Examiners should be aware that most forensic analysis applications, including [[EnCase]] and ProDiscover, will display ADSs found in acquired images in red.		Examiners should be aware that most forensic analysis applications, including [[EnCase]] and ProDiscover, will display ADSs found in acquired images in red.

@@ Line 32: / Line 32: @@
 == Transactional NTFS (TxF) ==
-According to [http://msdn.microsoft.com/en-us/library/bb968806%28v=VS.85%29.aspx MSDN] Transactional NTFS (TxF) allows file operations on an NTFS file system volume to be performed in a transaction.
+According to MSDN Transactional NTFS (TxF) allows file operations on an NTFS file system volume to be performed in a transaction.
 Several TxF related file-system-metadata files can be found in the file-system-metadata directory: \$Extend\$RmMetadata\. TxF also uses the MFT attribute $LOGGING_UTILITY_STREAM with the name $TXF_DATA.
@@ Line 40: / Line 40: @@
 == External links ==
 * [http://en.wikipedia.org/wiki/NTFS Wikipedia: NTFS]
 [[Category:Disk file systems]]