3 ms·
Do you have any examples of failures? I’d like to know what specifically is not working.
by acqq 8y ago
Do you have any examples of failures? I’d like to know what specifically is not working.
- mehrdadn 8y agoExtended attributes? That is the specific example. Create a file with EAs and see if you can back up and restore it with the same EAs.
- acqq 8y agoWhere are the NTFS EA used, if that's what you're writing about? I can't find anything except: https://flatcap.org/linux-ntfs/ntfs/attributes/ea.html https://flatcap.org/linux-ntfs/ntfs/attributes/ea.html "Used to implement the HPFS extended attribute under NTFS." Is your complaint is that the tools that are used to make the image of the installation files of the Windows don't include that? I assume that $EA entries don't exist in the installation files of Windows, for which the DSIM tool is used (and it's surely not an universal backup tool). And how do you read or write these? And what do you use them for? I was able to find only ZwSetEaFile and ZwQueryEaFile which are documented for kernel-mode drivers? Are there any plain user-level API's? https://attack.mitre.org/techniques/T1096/ https://attack.mitre.org/techniques/T1096/ I also find: "it may (be) worth noting that Windows does not contain any api that can be used to remove extended attributes."
- mehrdadn 8y agoWSL uses them for one (so good luck backing up WSL installations) https://blogs.msdn.microsoft.com/wsl/2016/06/15/wsl-file-system-support/ https://blogs.msdn.microsoft.com/wsl/2016/06/15/wsl-file-sys... Other stuff does too, e.g. https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/kernel-extended-attributes https://docs.microsoft.com/en-us/windows-hardware/drivers/if... Those are user-level APIs as well, though usually called via NtQueryEaFile and NtSetEaFile. And (part of) my complaint is that DISM's /EA flag is broken.