A Personal First: A Rootkitted 64 Bit Operating System And A Nice Boot Disc From Microsoft To Clean It

This week I encountered a 64 bit Windows machine infected with a rootkit.

It’s a Vista Home Premium SP2 system and it was doing some strange things.  The fake hard drive is failing warnings were the first I’ve seen of that variation but very much in the school of fake anti-virus pop-up windows.  Internet Explorer kept popping open unbidden and crashing, with mystery audio playing out of apparently nowhere (Vista’s Volume Mixer didn’t identify it as being from any particular application).  The audio included voices in conversation saying strange and partly intelligible things followed by strange laughter.  It also included something that sounded like what you’d find from Flash video from any number of major websites.

The usual anti-malware tools, Malwarebytes Anti-Malware and installed anti-virus (in this case Microsoft Security Essentials), cleaned up the fake warnings after I disabled them in Safe Mode and could actually run the tools.

The Internet Explorer issue and the strange audio didn’t resolve, and when I let Windows Update install some drivers that included an Intel Storage ICH9M-E/M SATA AHCI controller Vista had a complete BSOD freak out upon rebooting.  The blue screen was OxED Unmountable Boot Volume, not really something you want to see, and only booting from the Vista setup disc and letting it System Restore got me back into Windows.

(The Startup Repair from the hard drive would only give me a welcome screen with "Other User" as the login account. At the bottom left corner was an "Ease of Access" blue button.  I had no password for Other User and when I clicked on it I had the option to enter a user name and password but none of the existing accounts would work.)

My suspicions were severely raised at this point so I thought I’d try out Microsoft’s Standalone System Sweeper Beta.  I downloaded the 64 bit version of the installer and chose to let it create an ISO image that I burned to one of my handy DVD+RW discs.  (They are great for exactly this sort of thing.  If I need the Sweeper with newer definitions I just create a new ISO and burn it to the same disc.)  The web site says the Sweeper needs to be the same architecture as the target machine.  I don’t think you can run the 64 bit version on a machine with a CPU that only is 32 bit compatible and in any case the Sweeper will not let you scan an operating system that is a different architecture than the one you are booting.   If you boot the 32 bit Sweeper you can’t scan a 64 bit operating system and vice versa.  You can make either the 32 or 64 bit Sweeper boot disc regardless of which operating system is installed on the computer on which you are creating the disc.

Anyway, the Sweeper found the Alureon\TDSS\TDL3 rootkit (info here, here and here) and removed it.  When I got back into Windows I used Kaspersky’s TDSSKiller to remove leftover bits.  It’s possible that TDSSKiller alone would have done the job but I like the idea that I scanned Windows from outside the operating system and any rootkit would be inactive.

The system seemed snappier and considerably less strange afterwards.  Internet Explorer stopped opening spontaneously and stopped crashing and there wasn’t the odd 50% CPU action I had seen from some Dell applications threads before the cleaning.

I was quite pleased to have the Microsoft Sweeper since I can’t run GMER in a 64 bit operating system.  The very measures (mandatory signed drivers, etc.) that make it hard to rootkit a 64 bit system also make it harder to build anti-rootkit software, and the reduced vulnerability makes going to that effort significantly less worthwhile.  The fact that 64 bit operating systems are harder to infect made the dearth of cleaner tools not matter for a time, but now that this 64 bit capable rootkit is in the wild the story has changed.

The Sweeper installer can burn a disc directly for you and it can also build or update a bootable USB flash drive.  You will need an Internet connection to download the latest files and you’ll need 250 MB of space on a CD, DVD or flash drive.  The first time it creates the flash drive it formats it, but you can still use the balance of its capacity for storage after that.  When the installer updates the flash drive it doesn’t format it again or mess with any other content.  It just updates the virus definition file (about 60 MB).  This is very, very handy.

If you have a live connection to the Internet on the target machine the Sweeper can update its virus definitions when it is booted.  You can also download the definitions manually on another computer and put them on removable media to import from when the Sweeper is run.  Browse to http://go.microsoft.com/fwlink/?LinkID=96776 and download either the 32 bit or 64 bit definitions for Microsoft Security Essentials.  The Sweeper seems to be a standalone version of Microsoft Security Essentials so they use the same definitions.

A note on system requirements:

Microsoft gives a single list of requirements for both the installer computer and the target computer.  To work, they suggest the Sweeper needs the system to be Windows XP Service Pack 3 or newer with at least a 500 MHz or 1 GHz processor and 768 MB of RAM or 1 GB of RAM respectively depending on whether the operating system is XP or Vista/Windows 7.  This is awfully fuzzy “information”.

I tested the 64 bit Sweeper in VirtualBox on a target Windows 7 64 bit operating system and set it to use varying amounts of RAM.  At 752 MB or less the Sweeper will boot but can’t load its virus definitions so it won’t let you scan.  That’s great if you want to show somebody a Windows 7 looking startup screen (the Sweeper boots what looks like a Windows 7 Preinstallation Environment) but for cleaning a system it is useless.  At 753 MB it will boot and load the definitions and scan but it can’t update its definitions.  Still, that’s usable and the scan will be as current as your boot disc’s virus definitions.  At 843 MB it will successfully download updates to its virus definitions.

Using Windows Virtual PC and the 32 bit version of Sweeper, I found at up to 633 MB it couldn’t load its definitions and therefore wouldn’t scan.  Starting at 634 it could load its definitions but not update.  Starting at 714 MB it could could boot, scan and update its virus definitions properly.

To summarize, the 64 bit Sweeper is functional at 753 MB or higher and fully functional starting at 843 MB of RAM while the 32 bit version is functional at 634 MB and fully functional at 714 MB.

I also found that with sufficient RAM the Sweeper will boot and scan a Windows 2000 machine (although it failed to update with code 0x0072ee7 “server could not be resolved”, but a manual update from media worked) so it looks like the operating system requirement is more for the installer than the target computer.  That makes sense.

Windows 7 Forums has a nice tutorial on creating and using the Sweeper.

There are a couple more tutorials from Ask Leo! and Security Garden.  The latter also has a useful article called Solve Microsoft Standalone System Sweeper Errors.

Making OS X Play Nicely (Read/Write) With The NTFS File System

There is supposed to be native support for Read/Write access to NTFS formatted drives from Max OS X 10.6 Snow Leopard.  Word on the street is that this turned out to be unreliable and unstable so it is disabled by default (but it can be enabled from the command line).  OS X still has stable native Read Only access to NTFS but you can’t write to it.

At least you can’t without paying something for Paragon NTFS or paying nothing for the open source Catacombae NTFS-3G for Mac OS X and FUSE for OS X (OSXFUSE).  NTFS-3G is the NTFS Read/Write driver and FUSE is… well let’s just quote the relevant Wikipedia article:

Filesystem in Userspace (FUSE) is a loadable kernel module for Unix-like computer operating systems that lets non-privileged users create their own file systems without editing kernel code. This is achieved by running file system code in user space while the FUSE module provides only a "bridge" to the actual kernel interfaces.

There was an older FUSE that I had originally found called MacFUSE which is the project from which OSXFUSE is derived but I had trouble finding 64 bit support.  A lead from a blog called offTheHill brought me to OSXFUSE where I found 32 and 64 bit support ready to go in an easy to install DMG file.

I downloaded and installed the DMG files for NTFS-3G and OSXFUSE and unmounted and remounted the NTFS external drive and voila…. there was Read/Write access to the NTFS drive.

Obligatory warning: NTFS-3G is sometimes described as “experimental” given that there is no public specifications for the NTFS file system.  However, this project is mature enough that I would trust it with my data.

An Amusing Hack To Fix A Broken AVG Free Updater

I was helping someone with their computer when I noticed that their AVG Free hadn’t updated since October 5th.  When I clicked Update Now it would hang when it got to the point where it was “Analyzing new updates”

Apparently this is now a known issue for AVG on XP 64 bit systems.

After a little browsing online I found that a workaround was available for users of the paid AVG version.  It involved changing the Advanced Settings so that AVG first looked to the secondary update server rather than the primary update server.

The catch for users of AVG Free is that there is no option to change the update servers or their priority.

It occurred to me that while I couldn’t change the name of the primary update server I could certainly change the IP number that Windows used to go find that server.  I added this entry to the C:\WINDOWS\system32\Drivers\etc\hosts file:

212.96.161.241    guru.avg.com

The IP number is actually the address of the secondary update server bguru.avg.cz, so when AVG does its normal update it thinks it is checking the primary server but is actually checking the secondary server.

But there’s a rub….  AVG protects the Hosts file in order to prevent exactly this sort of chicanery which can be used for very nefarious purposes.  It will block this change or perpetually alert about the change even if it has been ignored.

Fortunately I was able to add the Hosts file to AVG’s Resident Shield’s Exceptions list.  I couldn’t enter the file by choosing it from the Add File button but I could add the path to the Drivers folder and then use the Edit List button to change it to point specifically to the Hosts file within the etc folder.

AVG update works perfectly with this arrangement.  However, now the Resident Shield is not protecting against any other changes to the hosts file.  That should be fine if the machine is clean, since having updated definitions should block incoming infections.  If the machine gets infected and starts messing with the Hosts file then it could be a big problem, for example preventing the anti-virus program from updating or sending seemingly innocuous web links to very bad places.

I estimated that the benefits exceeded the risks in this case especially since it is for a limited time until I revert the changes when AVG issues their final fix.

My Disc Runneth Over: When you want to burn more than will fit on a disc, try CDBurnerXP’s disc spanning

I generally use Nero Express for burning files to disc.  It’s quick and easy and the software came free with my burner.  However, when I need to burn more than the 4.7 GB a single layer DVD can record or when I’m using another person’s computer I need an alternative.  Nero Express may not be installed and even if it is it cannot span a backup job over multiple discs. 

(If you have NeroBackItUp installed you can span as many discs as you need, but if you want to read the files with anything other than NeroBackItUp you have to click the More button on the screen where you choose the target drive and de-select the “Compress data before backup” option.)

A nice free solution is CDBurnerXP.  CDBurnerXP is available in native 64 bit or 32 bit versions and can burn data or audio CDs or DVDs.  It can create an image of a disc or burn a disc from an image.  It can create bootable discs and of course it has an option to span large backup jobs over multiple discs.  Click on Disc then Disc Spanning and choose the size and type of disc you are using (CD or DVD, single or dual layer) and choose whether you want it to “Use as few discs as possible” or “Do not split folder contents unnecessarily”.

Be advised that the default CDBurnerXP installer offered on their home page uses OpenCandy to suggest additional software (for me it was a driver scanner) during the install.  The additional software can be declined but some people have privacy concerns given that OpenCandy says they retrieve a one-time message with “NON-personally identifiable” information.  According to their privacy policy, this may include “information regarding your geo-location, operating system, language setting”, whether you already have some of the suggested software installed and whether you decline their offer.

Fortunately CDBurnerXP’s download page provides the optional of an alternative installer without OpenCandy.  Just click on “More download options” under “Download latest version”.

I’ve used the wrong tool, now I’ve got to clean up my mess: How I deleted Vista / Windows 7 default shortcuts and got them back again

I’ve used CleanUp! 4.5.2 for a long time for purging temporary folders, especially before rescanning for malware or defragging a disk.  It’s worked very well for me on XP and Windows 2000 computers.  It cleans up browser cache folders and Temp folders for all users and it even makes an amusing flushing sound as you run it (optional).

It doesn’t work so happily on Vista or Windows 7.

Now I should say that CleanUp! 4.5.2 doesn’t say it supports any operating system past XP and it does warn “it is strongly recommended that you first run it in the new demo mode and verify the files that would be deleted before you first run it for real.”

I didn’t use the demo mode.  I got so used to it working so nicely in XP that I didn’t think about it.  Mea culpe.  (That’s how the ancient Romans used to say “my bad”.)

In Vista and Windows 7, CleanUp! ends up deleting the default shortcuts that you see in your Start Menu / All Programs.  Not nice.

These shortcuts in XP would be stored in C:\Documents and Settings\<User>\Start Menu and C:\Documents and Settings\All Users\Start Menu.

In Vista and Windows 7 you can find them in C:\Users\<User>\AppData\Roaming\Microsoft\Windows\Start Menu and for All Users in C:\ProgramData\Microsoft\Windows\Start Menu.

Ok, so you know where they are supposed to go but how do you get them back?

Some very nice folks explain “How to Restore Missing Default Start Menu Shortcuts” and even provide a zipped package of shortcuts belonging to the Current User and All Users for the various editions of Vista and Windows 7.

That’s great.  The links in the zipped files are correct and safe and just what you want but when you extract them to the correct folder and try to use them you get “Open File – Security Warning” each time.  That’s very annoying.  If you check their Properties you’ll see “This file came from another computer and might be blocked to help protect this computer”.  Look, there’s a handy Unblock button that eliminates this security warning.  Now do we have to do this over and over again for each individual file?

Fortunately the answer is no.  I got the solution and some discussion from this page and this page.  They both suggest downloading the Streams CLI executable from Microsoft’s Windows Sysinternals pages.  From a command line, type “streams -s –d” followed by the name of the file or directory you want to fix.

The reason you have to Unblock the files is that when they are downloaded to an NTFS file system a small Alternate Data Stream (ADS) is added to say they might be unsafe to run.  Running “streams –d” deletes that data stream which turns off the warning.

Some of the discussion on the second page mentioned above talks about the potential dangers of deleting Alternate Data Streams, but apparently downloading a file strips it of any streams it has and just adds the “:Zone.Identifier:$DATA” unsafe to run warning as the only stream.  It should be safe to delete the streams of any downloaded file.  Just be careful around other files sitting on your NTFS drive.  You can use AlternateStreamView from Nirsoft to view streams and delete them specifically.

(Because ADS is a function of NTFS, you could also copy the files to a FAT formatted flash drive and back again and they should be unblocked.)

For more information check out the “About Alternate Streams in NTFS File System” section of the AlternateStreamView page.

NirSoft has many other really cool utilities that you should check out.  I especially like CurrPorts: TCP/IP Connections Viewer, ShellExView, BlueScreenView and WirelessKeyView.  Be advised that while I’ve found NirSoft to be reputable and their tools to be safe, some anti-virus programs flag their password recovery utilities as Potentially Unwanted Programs or Hacktools.  Don’t worry.  They could be used for nefarious purposes but there is nothing wrong with them in and of themselves.

If you want to learn more about Alternate Data Streams, you can check out the Practical Guide to Alternative Data Streams in NTFS as a primer or to read about the security risk in ADS check out Symantec’s Windows NTFS Alternate Data Streams.

If you have any suggestions for a really good temp file clean up utilities that work in newer versions of Windows, please let me know.  The classic is CCleaner but I wish I could more easily turn off wiping Most Recently Used (MRU) entries from the default settings when I install it on a client’s machine.  TFC - Temp File Cleaner by OldTimer is simple and effective but it can’t be used remotely because it kills the remote access process and then when it’s done it waits for user input before rebooting.

Sometimes correct isn’t good enough: Trouble sending email from Mac OS X Mail

So I’m troubleshooting a problem sending email in the OS X “Snow Leopard” Mail program.  The settings are correct: the SMTP server’s name is right, “Use default ports” is selected, SSL is turned off and Authentication is set to None.  However, every time I try to send the email I get an error “"Cannot send message using the server <server name>”.

I run the Connection Doctor with “Show Detail” selected and see references to ports 587 and 110 but no mention of the default outgoing message SMTP port 25.  Suspicious, I end up going back to Edit SMTP Server List and choose “Use custom port” and enter 25.  What do you know, the outgoing message goes through as happy as can be.

I tested this on another machine with the same problem and again sending worked properly after I set the custom port to 25.  Interestingly, it continued to work after I switched it back again to “Use default ports”.

This is the third particularly noteworthy time I’ve experienced a case where apparently correct settings simply fail to work.  On a Windows 2000 Server I was sharing a folder to the network and made sure the sharing and NTFS permissions were correct.  It just wouldn’t share.  I ended up resetting the share and NTFS permissions and then set them up again exactly the same way as I had originally but this time it worked like a charm.

More recently I was configuring port forwarding on a Linksys router for a Remote Desktop Connection.  The incoming port was correct and the workstation’s static IP address was right.  I could connect from the LAN but not through the router.  I ended up changing the IP address for an existing custom RDC port forward to direct it to the new machine (and set the listening port to match) and it worked perfectly.  Both forwards should have worked but only one did.

This is along the same lines as other situations I’ve experienced where some program option is correct but it’s not working.  Change the option to something wrong and then switch it back to the correct setting and it works.  What’s different?  Apparently nothing, but something changed “under the hood”.  The original setting had not registered properly but changing it and changing it back made the difference.

Sometimes computers aren’t logical, at least not at the user interface level.

Internet Explorer 10 Platform Preview 2 and Page Visibility

The Internet Explorer 10 Platform Preview 2 caught my eye today.  Since I’ve found that IE 9 is a significant improvement on IE 8 for those machines that have the hardware to run it properly, I was curious to see what was new in IE 10.

While there are some page layout features that are going to make life much easier for webmasters, the things that interested me most were the Web Workers and Page Visibility components.

The Web Workers feature breaks off CPU intensive JavaScript code and runs it separately in the background so as to avoid hanging the page itself and to allow the JavaScript to run multi-threaded and so make use of the power of multi-core processors.

I like Page Visibility even more for my own special reasons.  For the first time the browser can keep track of whether you can actually see a given page and so the pages can be coded so they don’t waste computing power being active when you’re not actually looking at them.  When the browser window is minimized the page knows that it is hidden and can take a breather.  Hopefully this is true when you select another tab in the same window.  I expect so but I can’t test it because the Platform Preview only displays one page.

Why am I so interested in Page Visibility?  My last computer had a Pentium 4 1.8 GHz processor and 512 MB of RAM.  Fielding tech support calls from various clients in a day, I found myself opening an increasing number of windows and tabs in Firefox.  I’d open at least one window per client and 5 to 15 tabs and then leave them open until I had time to bookmark the best pages.  This brought my system to its knees.  I added an extra gigabyte of RAM and that helped some but all those tabs would run up my CPU usage towards 100% as all those pages animated or updated or whatever they were doing in the background.

My current computer has a quad-core 2.8 GHz processor and 8 GB of RAM and so far handles my web abuse quite well.  However, given my recent personal best 32 windows including 286 tabs, the overall CPU usage often exceeds 50, 60 and sometimes 70%.  My system is still quite responsive but it sucks power and spits out heat.  In the summer without air conditioning I can feel it warm up the room.

With Page Visibility I could keep open an insane number of tabs and have them resting comfortably when I’m not looking at them.  And that will keep me resting (read “slaving away) comfortably as well.

If you are intereted in reading more about IE 10 PP 2 here are a couple of reviews I found interesting:

Internet Explorer 10 Platform Preview 2 shows strong progress
Internet Explorer 10 Platform Preview 2 is to die for

Recover iTunes Library From an iPod, Especially an iPod Touch

Scenario: Your hard drive fails and you replace it but you have no backup of your iTunes library and playlists except on your iPod.

First, don’t let iTunes sync an empty library to your full iPod.  Disable iTunes automatic sync.  It warned me before trying to sync but I’m not sure if it always does that.

Next, retrieve the contents of the iPod.

You used to be able to use PodLift to quickly dump the iPod’s contents to your computer but it doesn’t work on newer iPods and the author is no longer developing the program.

If your iPod can show up as a removable drive in Windows Explorer (you may have to enable this option in iTunes) you can restore your library manually.  Here’s a nice summary of the procedure.

The process isn’t trivial but isn’t too bad once you’ve managed to convince Windows to show hidden files and folders.  From that point you just look in the iPod’s hidden iPod_Control folder and the likewise hidden Music sub-folder.  Within that you will find not very descriptive folder names containing MP3s and whatnot with not very descriptive file names.

At this point you can copy the music to your hard drive or get ready to import it directly into iTunes.  I like the idea of having a spare copy in case something messes up or you accidentally sync the empty library and wipe the iPod.

Even though you can see the music files in Explorer, you may have to unhide the music files so iTunes can see them.  Just select everything, right-click, and change the Properties so they are not Hidden.

Make sure iTunes is set to manage your music files and to copy them into its iTunes Music folder hierarchy.  Then import all the music.  iTunes will copy the music files into artist and album folders and rename the files themselves according to their metadata such as ID3 tags.

Recovering an iPod touch presents a roadblock for this procedure in that it will show up in My Computer but it won’t show up as a removable drive.  You can’t get at the hidden folders.

Enter GizmoRip.  It picks up where PodLift left off.  It can access the contents of an iPod Touch plus it has features to let you recover playlists and metadata, copy the music files or just import them directly into iTunes.  It also has a feature to rip pictures from your iPod.

I had trouble downloading from the http://www.gizmorip.com/ web site but you can also get it from Download.com.

Why does Apple make it so hard to recovery your music from your iPod?  Speculation is that it’s to appease the music rights holders who fear that you might suck the entire music library off of every iPod you can borrow.  This is especially true now that iTunes and others have abandoned restricting playback to only authorized media devices.

I don’t know if this is their actual motivation but they seem to persist in changing iPods to ensure difficulty in offloading music.

I do know that this is one of the reasons that I listen to my music from my BlackBerry and don’t feel the urge to buy an iPhone.  In the BlackBerry the memory card has a straight up standard file system.  I can easily recover the contents if needed and I can sync it with whatever program I choose or just copy the music manually using Windows Explorer.

Removing Duplicate Files

As a follow on to my previous post about the Link Shell Extension software and hard links, I thought I’d say something about finding and removing duplicate files especially now that I’ve found a free program that can turn duplicates into hard links.

I had been using Easy Duplicate Finder version 2.2.4 and was fairly pleased with it.  It finds duplicates based on parameters such as name and file size as well as content (based on a byte to byte comparison or a hash of the whole file) and had a good selection assistance feature.

However, it seems any version of Easy Duplicate Finder above 2.4 is no longer free, so when I started having a few crashes with it I went looking for an alternative free duplicate finder.

My favourite resource for finding new freeware is Gizmo's Freeware.  They have volunteer editors who review freeware in different categories, explain the differences and give their recommendations.  Their Best Free Duplicate File Detector page led me to try Duplicate Cleaner.

I’m quite pleased with Duplicate Cleaner.  In addition to having all the features of Easy Duplicate Finder, it has a better Selection Assistant and a variety of File Removal options that include Delete, Delete to Recycle Bin, Move, Copy, Rename and of course the aforementioned Create Hardlinks.

I use hard links when I’ve been sorting things like pictures to upload somewhere and really just want to keep the selection for reference and don’t need a spare copy of the photos.  I use Link Shell Extension now for making hard linked copies of my pictures without taking up any more disk space but for those selections I’ve made before I can clean them up with Duplicate Cleaner’s Create Hardlinks options.

The Create Hardlinks is a very safe option in that you can’t accidentally delete something with it.  It will only make a hard link to identical file contents and the only thing removed is the second copy of that identical data.  The duplicate file is still there but under the hood it only points to the original copy of the file.  However, if the original is ever deleted then the duplicate becomes the sole and complete copy of the file.

Most people are just going to use Duplicate Cleaner for actually deleting duplicates and I’d use it for that even if it didn’t have the extra hard links feature.  I really like the options to select from a list of duplicates using “Select by Location” where it keeps the files from one specific folder path and “Select by text pattern” where I can Mark or Unmark based on any string of text in the file name.

The text pattern has a Column Name drop down box where you can switch to searching for path, creation date, image size, bit rate and a variety of other fields that you would see if you right clicked the file, clicked Properties and chose the Details tab.

The beautiful thing is that you can mark or unmark to augment your original selection criteria.  It doesn’t wipe your existing selections and go only by the text pattern.

Be aware when running the Duplicate Cleaner installer that there is optional sponsor software (currently Bing Toolbar) that you can uncheck if you don’t want it included.

Link Shell Extension, Hard Links and Sorting Pictures For Upload

Here’s the scenario:  We want to upload a large selection of pictures to Facebook or an online photo printing service and keep a local reference copy of that selection but we don’t want to take up hard drive space with duplicates of our pictures.

It’s tedious to choose the photos manually from the uploader interface and that way we don’t have a record of what’s been uploaded without going online.  We want to have a folder that includes all the pictures that we will be uploading.

Our photos are stored in a subfolder tree based on year, month and date taken.  If we just drag and drop them to a folder of selected pictures we lose them in their original date sorted folders.  If we copy and paste them we have duplicate copies using up hard drive space.

Enter Link Shell Extension and hard links.  Link Shell Extension (LSE) is a third party program that adds context menus to Windows Explorer to allow easy access to NTFS native support for hard links.  Right click on the folder you want to duplicate, left click on Pick Link Source, go to your destination folder, right click again, highlight Drop As… and select Hardlink Clone.

It looks like you’ve made a duplicate copy of your original picture folder but if you look closely there is a little red shortcut arrow on both the originals and the duplicate copies showing that they are hard linked.  If you check the properties of each folder they will be the same size but the duplicates will not actually be taking up real space on your hard drive since they are only pointers to the location the original file is stored.  If you wanted you should be able to make a duplicate copy this way of all the folders on your computer and it won’t actually write another copy of the files.

In this case we have an apparently full copy of all our pictures and we can either drag and drop them to a selection folder or just delete the pictures we don’t want.  The original picture folders are unaffected.

Hard linked files can be treated exactly like they were the real file.  Edit the file and the file in the original folder will be changed too.  You can create up to 1023 hard links per file.  The interesting bit is that both the original and duplicates of hard link files are just pointers to where the content of that file is stored.  If you delete the duplicate the original is still there.  If you delete the original the duplicate is still there.  If you delete both of them then the file is really gone and you’d have to use an undelete program to get it back.  NTFS has a counter for how many file names refer to the actual file.  When that number drops to zero the file is gone from the file system.  If the red shortcut arrow icon disappears you’ll know that’s the last link to that file.

Hard linked files can be very handy but they can cause some interesting side effects.  On a client’s computer a backup program (I believe it was Nero BackItUp) backed up selected data folders to a backup folder in C:\ (the same physical disk was not a great location choice for a backup).  C: drive was 1 TB and the backup folder reported it was over 2 TB in size.  Apparently the backup program created an actual duplicate of the data files the first time it ran.  Subsequent backups created in a date named folder actual duplicates of any files that were new or changed, but just hard links for all the files that were the same.  That’s handy insofar as you have an apparently complete copy in each subsequent backup folder.  Unfortunately, the antivirus program (AVG 9, I think) saw them all as unique files not as hard links and in scanning every hard link it wasn’t completing its nightly full scan before the start of work the next day.

With LSE installed you will also see different icons for Junction Points which function like a shortcut to a folder but in a way that is transparent to the user.  The My Pictures and My Music folders in the Documents folder in Vista or Windows 7 are just junction points that redirect the user to the folders named Pictures and Music that are actually located in their username folder.  In Windows XP the My Pictures and My Music folders are actually contained in the My Documents folder.

Tech Tech Tech Tech Boom

The post title alludes to the fact that I’ve been meaning to get this blog started for quite awhile now and finally here it is.

I intend for this blog to function as both a scratch pad for myself and a resource for anyone who cares to read it.

In the course of fixing a computer or trying to accomplish a task in a better (usually more automated) way, I find myself coming across handy software, useful techniques and valuable web sites that I’d like to remember and that could be of benefit to others dealing with something similar.  I’ll post about those here along with any general tech comments that come to mind.

Bryan