PDA

View Full Version : File Comments



BloodQuest
12-10-2008, 12:13 PM
I know I should know this, but I'm wondering if anyone knows how to set a file comment -- the type you can read by right-clicking a file in windows and looking at the properties tab...

Thanks!

Simon

PS And is there a MacOS equivalent?

DuneBoy
12-10-2008, 04:44 PM
That data is stored in an NTFS Alternate Data Stream (ADS), here are some links that should be helpful.

http://www.forensicfocus.com/dissecting-ntfs-hidden-streams
http://members.cox.net/slatteryt/Streams.html <- This one has info about the Summary tab's use of ADS.
http://support.microsoft.com/kb/105763 <- A bit of c source code.
http://technet.microsoft.com/en-us/sysinternals/bb897440.aspx <- An ADS utility.
http://en.wikipedia.org/wiki/Resource_fork <- Info for MacOS

Unless you're talking about the data that's in the Version tab of an exe or dll. That's compiled in as a resource. Here's some MS info about the VERSIONINFO block:
http://msdn.microsoft.com/en-us/library/aa381058.aspx

Usually that data is set via the IDE.

BloodQuest
12-10-2008, 10:58 PM
Thanks for the suggestions, but I may have led you astray.

The attached image should show what I'm referring to...

Simon

DuneBoy
12-10-2008, 11:11 PM
That's right, that tab uses an Alternate Data Stream for its data. Except for certain file types where it actually comes from inside the file, namely MS Office files in which case a special handler is used to read/write the file's data instead of using an ADS.

BloodQuest
12-14-2008, 12:41 AM
Thanks once again.

Having taken a look, I've chickened out of that approach, in favour of writing comments to a log! At least that will make the Mac compatibility a lot easier!

Cheers,

Simon

BTW, have we met? I occasionally manage to get to the LA user group meetings...

DuneBoy
12-15-2008, 06:33 PM
I know how you feel, I considered using ADS when I was writing Info Saver (http://www.lwplugindb.com/Plugin.aspx?id=8a6ea885) but also opted for a .txt file.

I've seen you at a couple meetings, and I was at Harry's the last time the Users Group met there for dinner (I sat next to Jessica). I remember the waiter asked if you wanted fries with your Fish 'n' Chips. Next time you're at a meeting I'll be sure to introduce myself.

Hopper
12-15-2008, 07:26 PM
ADS can also get you pretty screwed if you use it for purposes other than its original intent.

If you copy a file with and ADS entry to another file system that is not NTFS, you will lose the ADS portion.

BUT...

It sure is a good way to hide things... :D I used to use it to xfer passwords.