ntfs file system and data security -...
TRANSCRIPT
![Page 1: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/1.jpg)
NTFS File System and Data Security
Yanhui TuKingSoft
![Page 2: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/2.jpg)
Index
1 File System kernel analysis2 Stream and Data security3 Data recover4 Date overwrite
![Page 3: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/3.jpg)
NTFS File System Analysis• File• There are 2 different kinds• Metafiles: user can’t access• User files: User data
![Page 4: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/4.jpg)
NTFS File System Analysis• NTFS meta file
Metadata Function$MFT MFT itself
Part image of MFT $MFTMirr$LogFile Log file$Volume Volume file$AttrDef Attribute definition list$Root root directory$Bitmap Bitmap file $Boot Boot file
$BadClus Bad cluster file$Quota(NTFS4) Quota file
$Secure Secure file$UpCase Capitalized file$Extend Metadata directory
Extended Metadata directory
$Extend\$Reparse Reparse Points file$Extend\$UsnJrnl Log changing file$Extend\$Quota Quota management file $Extend\$ObjId Object ID file
![Page 5: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/5.jpg)
NTFS File System Analysis
• $MFT(Master File Table )• Includes all information about files, and these
information called attributes
• The NTFS file system contains a file called the master file table, or MFT. There is at least one entry in the MFT for every file on an NTFS file system volume, including the MFT itself
![Page 6: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/6.jpg)
Normal file MFTMFT header10H $STANDARD_INFORMATION
30H $FILE_NAME
80H $DATA and $BITMAP
MFT End
NTFS File System Analysis
![Page 7: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/7.jpg)
Resident attribute and non-resident attributeResident attribute save data in file data areaNon-resident attributes saved in MFT
NTFS File System Analysis
![Page 8: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/8.jpg)
Directory’s MFTMFT header10H(STANDARD INFORMATION)
30H(File Name)90H(Index Root )
A0H( Index Allocation)B0H(BitMapMFT END
NTFS File System Analysis
![Page 9: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/9.jpg)
NTFS File System AnalysisStructure of file
index• Index header
(every 4KB index block has a file index header.)
• Index item(every item record a file’s filename,MFT number, parent directory MFT number etc. )
![Page 10: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/10.jpg)
NTFS File System Analysis• $LogFile’s
MFTlog file’s structure is very complicated and it’s structures details are still unknown
![Page 11: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/11.jpg)
NTFS File System Analysis• $LogFile log
filelog file’s
structure is very complicated and it’s structures details are still unknown, we only know it’s separated into many 4k blocks and each block start with RCRD
![Page 12: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/12.jpg)
NTFS File System Analysis• $LogFile log
file recorded a example of file rename
![Page 13: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/13.jpg)
NTFS File System Analysis• Volume
file• Label in
offset 60H
![Page 14: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/14.jpg)
NTFS File System Analysis• $AttrDef
file• List of record all
attributes
![Page 15: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/15.jpg)
NTFS File System Analysis
• Content of $AttrDef
• Records all attributes definition
![Page 16: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/16.jpg)
NTFS File System Analysis• “.” file(root)
• Root of directory tree
![Page 17: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/17.jpg)
NTFS File System Analysis• 90H
attribute of root directory
![Page 18: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/18.jpg)
NTFS File System Analysis
• $Bitmapfile
![Page 19: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/19.jpg)
NTFS File System Analysis
• Content of $Bitmapfile
![Page 20: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/20.jpg)
NTFS File System Analysis
• $Boot file MFT
![Page 21: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/21.jpg)
NTFS File System Analysis• Content of
$Boot
![Page 22: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/22.jpg)
NTFS File System Analysis• Content of
$Boot
![Page 23: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/23.jpg)
NTFS File System Analysis
• $UpCasefile MFT
![Page 24: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/24.jpg)
NTFS File System Analysis• Content of
$UpCasefile
![Page 25: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/25.jpg)
NTFS File System Analysis
• $BadClusfile MFT
• It maintains a list of bad clusters on the drive.
![Page 26: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/26.jpg)
Stream and Data Security• Put file in
stream
![Page 27: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/27.jpg)
Stream and Data Security
• 29A released a stream based virus at 2000
• Currently no Anti-virus support stream scaning in China
![Page 28: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/28.jpg)
Stream and Data Security
• Stream in disk
![Page 29: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/29.jpg)
Stream and Data Security
• Stream in disk
![Page 30: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/30.jpg)
and Data Security Stream
• Stream can put in directory
![Page 31: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/31.jpg)
Stream and Data Security• API designed for stream
programing• 1、Travel :
– FindFirstStreamW and FindNextStreamW(Win2003server)
– BackupRead 和BackupSeek(Win2000)
• 2、Delete:– DeleteFile
• And if you can access stream without above APIs with knowledge of NTFS data structure
![Page 32: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/32.jpg)
Data Recover• Normally, user access
files by using file system, these files store on user’s hard disk and organized by file system and supply files to users.
• What users see are only files, users don’t care about how these file stored in disk, they can use commands supplied by OS to read and write files, but if one of data or file system is corrupted user can’t access files anymore.
![Page 33: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/33.jpg)
Data Recover• When file system is corrupt, we have 2
methods to recover data.• First method: Rebuild this file
system ,fix corrupt part, and system can access this file system normally and recover the lost data. For example: When hard disk’s partition table is corrupt, we can rebuild partition table to recovery data; If some partitions can’t access normally, we can rebuild BPB to fix that. This method is suitable for repairing some of key data, only need very small data of rebuild.
• Second method: Rebuild lost data to files from source devices. When try to rebuild some extremely unstable file system, like file data unsure before corrupted, or need large mount of data writing. This method is suitable for recovering deleted files, partition format scenarios.
![Page 34: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/34.jpg)
File Recover
• Scenario:When files deleted or format but not destroyed file data just deleted some file information on file system and release file spaces.
![Page 35: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/35.jpg)
File Deleting Processing
• Deleting file in FAT• 1、Replace first byte of directory’s
filename area to E5H• 2、Mark this directory to unused
![Page 36: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/36.jpg)
File Deleting Processing• Deleting file in NTFS• When deleting a file in NTFS need 3
changes:– 1. There is a byte at offset 16H of this
file’s MFT header. If 0 means this file is deleted, 1 means this file is using, 2 means this is a directory, 3 means this directory is deleted;
– 2. Parent directory attribute INDEX_ROOT(90H)or attribute INDEX_ALLOCATION(A0H);
– 3. Set 0 to file’s corresponding bits in $Bitmap.
![Page 37: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/37.jpg)
Recover Demo
• FAT recover demo• 1、Locate file directory items• 2、Analysis directory items• 3、Locate data area• 4、Save recovered file
![Page 38: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/38.jpg)
Recover Demo
• NTFS label recover• 1、locate file MFT• 2、MFT attribute analysis• 3、locate date erea• 4、Save recovered file
![Page 39: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/39.jpg)
Data Overwrite• (DoD )5220.22-M• a. Degauss with a Type I degausser• b. Degauss with a Type II degausser.• c. Overwrite all addressable locations with a single character.• d. Overwrite all addressable locations with a character, its
complement, then a random character and verify. THIS METHOD IS NOT APPROVED FOR SANITIZING MEDIA THAT CONTAINS TOP SECRET INFORMATION.
• e. Overwrite all addressable locations with a character, its complement, then a random character.
• f. Each overwrite must reside in memory for a period longer thanthe classified data resided.
• g. Remove all power to include battery power.• h. Overwrite all locations with a random pattern, all locations with
binary zeros, all locations with binary ones.• i. Perform a full chip erase as per manufacturer's data sheets.• j. Perform i above, then c above, a total of three times.• k. Perform an ultraviolet erase according to manufacturer's
recommendation.• l. Perform k above, but increase time by a factor of three.• m. Destroy - Disintegrate, incinerate, pulverize, shred, or melt.• n. Destruction required only if classified information is contained.
![Page 40: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/40.jpg)
Data Overwrite
m, nWrite Once, Read Many (Worm)
m, nRead Only
mcRead Many, Write Many
Optical Disk
a, b, d , or ma, b, or cRemovabel Rigid Disk
a, b, d , or mcNon-Removable Rigid Disk
ma, b, or cFloppies
ma, b, or cBernoullis
Magnetic Disk
ma or bType III
b or ma or bType II
a, b, or ma or bType I
Magnetic Tape1
SanitizeClearMedia
![Page 41: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/41.jpg)
Data Overwrite
c and f, g, or mc or gStatic Random Access Memory (SRAM)
mRead Only Memory ROM
c, g, or mc or gNonvolatile RAM (NOVRAM)
mcMagnetic Resistive Memory
c and f, or mcMagnetic Plated Wire
a, b, e, or mcMagnetic Core Memory
a, b, c, or mcMagnetic Bubble Memory
mcProgrammable ROM (PROM)
c then i, or miFlash EPROM (FEPROM)
l, then c, or mkErasable Programmable (ROM (EPROM)
h or miElectronically Erasabel PROM (EEPROM)
j or miElectronically Alterable PROM (EAPROM)
c, g, or mc or gDynamic Random Access memory (DRAM)
Memory
SanitizeClearMedia
• http://www.zdelete.com/dod.htm
![Page 42: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/42.jpg)
D or E level of Overwrite
• Method 1:• 1、Open file• 2、Write file• 3、Close file• Features:Simple but not safe
![Page 43: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/43.jpg)
D or E level of Overwrite• Method 2:• 1、Locate file’s MFT or Index in file
system • 2、Locate file’s physical address in
disk3、Write disk• Features:Complex(need very deep
knowledge in file system and disk structure)、Safe(can make sure overwrite on same place of file)
![Page 44: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/44.jpg)
References
• 涂彦晖 戴士剑. 《数据安全与编程技术》.北京:清华大学出版社,2005
• 戴士剑 涂彦晖. 《数据恢复技术》(第2版).北京:电子工业出版社,2005
![Page 45: NTFS File System and Data Security - xcon.xfocus.orgxcon.xfocus.org/XCon2006/archieves/Yanhui_Tu-NTFS_File_System... · NTFS File System and Data Security Yanhui Tu KingSoft. Index](https://reader031.vdocuments.us/reader031/viewer/2022020109/5c65ac3909d3f29b6e8d1daf/html5/thumbnails/45.jpg)
Thank YOU!