4NT8 and NTFS Streams

[lcaverly]

Hi,
I'm just starting to learn about NTFS Streams.

4NT8 is making it very easy.

Directory of C:\utils\jlc.txt

8/18/2009 9:35 11 jlc.txt
180 ♣SummaryInformation:$DATA
34 hidden:$DATA
56,832 sol2.exe:$DATA
0
{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}:$DATA

Here I've created an 11 byte test file called jlc.txt

To it I have attached another text file called hidden.

I have also added Windows Solitaire. Using DIR /: in 4NT I am able
to see the streams of this file.

Now, when I am in Windows Explorer, right click on the file, and
choose Properties, I can click on the Summary tab to add Title,
Subject, Author, etc.

I see that this is called SummaryInformation. Not sure what that
GUID-type stuff is at the bottom, but I see that it has a size of
zero.

Question: Is there any way, using 4NT8, that I can view the Summary
Information? I've tried;

C>type jlc.txt:♣SummaryInformation
4NT: Stream not found "C:\utils\jlc.txt:♣SummaryInformation"

and

C>type jlc.txt:♣SummaryInformation.
4NT: Stream not found "C:\utils\jlc.txt:♣SummaryInformation."

(the last one includes a period at the end of the line), but alas, I
cannot access the Summary Information.

If it is not possible to access this info from 4NT8, I could implement
this ability via a plugin that I would write, but I wanted to seek the
knowledge of others before re-inventing the wheel.

Thanks from Joe.

[lcaverly]

Hi,
  I'm just starting to learn about NTFS Streams.
  4NT8 is making it very easy.
If it is not possible to access this info from 4NT8, I could implement
this ability via a plugin that I would write, but I wanted to seek the
knowledge of others before re-inventing the wheel.
Thanks from Joe.

Just wanted to mention that I have no problem accessing the SOL2.EXE,
or other info, from the jlc.txt file, via 4NT8, only the Summary
information.

Joe

[Klaus Meinhard]

Post by lcaverly
Question: Is there any way, using 4NT8, that I can view the Summary
Information? I've tried;

From the Help for 4NT V.8, topic NTFS File Streams:

You can display stream names with the DIR /: option. The file processing
commands COPY, DEL, FFIND, LIST, MOVE and TYPE support file streams when
the stream name is explicitly specified; see the individual commands for
additional details. Other file-related commands, such as ATTRIB and
TOUCH work with the file as a whole, and not with any particular stream
or portion of the file data.

[E. S. Fabian]

lcaverly wrote:
| Hi,
| I'm just starting to learn about NTFS Streams.
|
| 4NT8 is making it very easy.
|
| Directory of C:\utils\jlc.txt
|
| 8/18/2009 9:35 11 jlc.txt
| 180 ?SummaryInformation:$DATA
| 34 hidden:$DATA
| 56,832 sol2.exe:$DATA
| 0
| {4c8cc155-6c1e-11d1-8e41-00c04fb9386d}:$DATA
|
| Here I've created an 11 byte test file called jlc.txt
|
| To it I have attached another text file called hidden.
|
| I have also added Windows Solitaire. Using DIR /: in 4NT I am able
| to see the streams of this file.
|
| Now, when I am in Windows Explorer, right click on the file, and
| choose Properties, I can click on the Summary tab to add Title,
| Subject, Author, etc.
|
| I see that this is called SummaryInformation. Not sure what that
| GUID-type stuff is at the bottom, but I see that it has a size of
| zero.
|
| Question: Is there any way, using 4NT8, that I can view the Summary
| Information? I've tried;
|
|| type jlc.txt:?SummaryInformation
| 4NT: Stream not found "C:\utils\jlc.txt:?SummaryInformation"
|
| and
|
|| type jlc.txt:?SummaryInformation.
| 4NT: Stream not found "C:\utils\jlc.txt:?SummaryInformation."
|
| (the last one includes a period at the end of the line), but alas, I
| cannot access the Summary Information.
|
| If it is not possible to access this info from 4NT8, I could implement
| this ability via a plugin that I would write, but I wanted to seek the
| knowledge of others before re-inventing the wheel.

Apparently the "Summary Information" is either a special stream, not
accessible by the 4NT/TCC commands supporting "normal" streams, or may even
be embedded in the file data. Undoubtedly MS Office documents, which can be
transported from one NTFS volume to another via FAT files (i.e., without
streams), are of the latter type. Similarly, the "version information" in
executable programs are part of the "program data". You should be able to
find out more about the Office file "summary information" via Open Office
documentation (by people who already decoded the MS data structures).

[lcaverly]

| Hi,
|   I'm just starting to learn about NTFS Streams.
Apparently the "Summary Information" is either a special stream, not
accessible by the 4NT/TCC commands supporting "normal" streams, or may even
be embedded in the file data. Undoubtedly MS Office documents, which can be
transported from one NTFS volume to another via FAT files (i.e., without
streams), are of the latter type. Similarly, the "version information" in
executable programs are part of the "program data". You should be able to
find out more about the Office file "summary information" via Open Office
documentation (by people who already decoded the MS data structures).
--
HTH, Steve

Hi,
Well, here's a VBScript I developed that obtains the summary
information from my simple text file (jlc.txt);

Dim objShell, objFolder, strTheFileName
Set objShell = CreateObject("Shell.Application")
Set objFolder = objShell.NameSpace("C:\UTILS")
strTheFileName = "jlc.txt"
Wscript.echo
'Name
Wscript.echo objFolder.GetDetailsOf(objFolder.ParseName
(strTheFileName), 0)
'Size
Wscript.echo objFolder.GetDetailsOf(objFolder.ParseName
(strTheFileName), 1)
'Type
Wscript.echo objFolder.GetDetailsOf(objFolder.ParseName
(strTheFileName), 2)
'Date Modified
Wscript.echo objFolder.GetDetailsOf(objFolder.ParseName
(strTheFileName), 3)
'Date Created
Wscript.echo objFolder.GetDetailsOf(objFolder.ParseName
(strTheFileName), 4)
'Date Accessed
Wscript.echo objFolder.GetDetailsOf(objFolder.ParseName
(strTheFileName), 5)
'Attributes
Wscript.echo objFolder.GetDetailsOf(objFolder.ParseName
(strTheFileName), 6)
'Status
Wscript.echo objFolder.GetDetailsOf(objFolder.ParseName
(strTheFileName), 7)
'Owner
Wscript.echo objFolder.GetDetailsOf(objFolder.ParseName
(strTheFileName), 8)
'Author
Wscript.echo objFolder.GetDetailsOf(objFolder.ParseName
(strTheFileName), 9)
'Title
Wscript.echo objFolder.GetDetailsOf(objFolder.ParseName
(strTheFileName), 10)
'Subject
Wscript.echo objFolder.GetDetailsOf(objFolder.ParseName
(strTheFileName), 11)
'Category
Wscript.echo objFolder.GetDetailsOf(objFolder.ParseName
(strTheFileName), 12)
'NOTE: There are a total of 37 elements for which you can
GetDetailsOf.
'I have demonstrated the first 12

It returns all of the info that I set under Properties in Windows
Explorer.

I'll develop some wrapper functions in 4NT8 for the VBScript, and post
the functions when I have them complete.

Joe

[lcaverly]

| Hi,
|   I'm just starting to learn about NTFS Streams.
Apparently the "Summary Information" is either a special stream, not
accessible by the 4NT/TCC commands supporting "normal" streams, or may even
be embedded in the file data. Undoubtedly MS Office documents, which can be
transported from one NTFS volume to another via FAT files (i.e., without
streams), are of the latter type. Similarly, the "version information" in
executable programs are part of the "program data". You should be able to
find out more about the Office file "summary information" via Open Office
documentation (by people who already decoded the MS data structures).
--
HTH, Steve

Hi,
  Well, here's a VBScript I developed that obtains the summary
information from my simple text file (jlc.txt);
Dim objShell, objFolder, strTheFileName
Set objShell = CreateObject("Shell.Application")
Set objFolder = objShell.NameSpace("C:\UTILS")
strTheFileName = "jlc.txt"
Wscript.echo
'Name
Wscript.echo objFolder.GetDetailsOf(objFolder.ParseName
(strTheFileName), 0)
'Size
Wscript.echo objFolder.GetDetailsOf(objFolder.ParseName
(strTheFileName), 1)
'Type
Wscript.echo objFolder.GetDetailsOf(objFolder.ParseName
(strTheFileName), 2)
'Date Modified
Wscript.echo objFolder.GetDetailsOf(objFolder.ParseName
(strTheFileName), 3)
'Date Created
Wscript.echo objFolder.GetDetailsOf(objFolder.ParseName
(strTheFileName), 4)
'Date Accessed
Wscript.echo objFolder.GetDetailsOf(objFolder.ParseName
(strTheFileName), 5)
'Attributes
Wscript.echo objFolder.GetDetailsOf(objFolder.ParseName
(strTheFileName), 6)
'Status
Wscript.echo objFolder.GetDetailsOf(objFolder.ParseName
(strTheFileName), 7)
'Owner
Wscript.echo objFolder.GetDetailsOf(objFolder.ParseName
(strTheFileName), 8)
'Author
Wscript.echo objFolder.GetDetailsOf(objFolder.ParseName
(strTheFileName), 9)
'Title
Wscript.echo objFolder.GetDetailsOf(objFolder.ParseName
(strTheFileName), 10)
'Subject
Wscript.echo objFolder.GetDetailsOf(objFolder.ParseName
(strTheFileName), 11)
'Category
Wscript.echo objFolder.GetDetailsOf(objFolder.ParseName
(strTheFileName), 12)
'NOTE: There are a total of 37 elements for which you can
GetDetailsOf.
'I have demonstrated the first 12
It returns all of the info that I set under Properties in Windows
Explorer.
I'll develop some wrapper functions in 4NT8 for the VBScript, and post
the functions when I have them complete.
Joe

Hi,
Well, after reading the 4NT8 help file in more detail, I discovered
the @SUMMARY variable function.

Example;
echo %@summary[jlc.txt,Author]

Does what I need it to do. Not only does it work with compound
files, but one can set the values, as well as get the values.

Oh well, I learned a little more about VBScript anyways.

Joe