WIN: Windows File System

File System History

When Windows was first released, it used the FAT (File Allocation Table) file system. FAT was simple and compatible but had significant limitations: it did not support large files (over 4 GB) and offered no advanced security features.

Evolution of Windows File Systems

In 1993, with the release of Windows NT 3.1, NTFS (New Technology File System) was introduced. NTFS addressed the limitations of FAT by supporting large files, offering advanced security, and using disk space more efficiently. NTFS is the default file system for Windows today.

In 2006, Windows Vista introduced exFAT to replace FAT32 for portable storage devices. While not as advanced as NTFS, it is simpler and better suited for USB drives and memory cards.

NTFS

NTFS is known as a journaling file system. In the event of a failure, the file system can automatically repair folders and files on the disk using information stored in a journal file. This function is not possible with FAT.

NTFS Advantages Over FAT

• Supports files larger than 4 GB
• Set specific permissions on folders and files
• Folder and file compression
• Encryption via Encrypting File System (EFS)
• Security: More robust access control model
• Scalability: Supports larger file sizes and drive capacities
• Reliability: Journaling enhances data integrity and recovery

FAT File System              NTFS File System
-------------------          -------------------
No journaling                Journaling (auto-repair)
No file permissions          Full ACL permissions
4 GB file size limit         No practical file size limit
No encryption                EFS encryption support
No compression               Built-in compression

Access Control List (ACL)

ACL stands for Access Control List. This list determines who can access a resource (file, folder, printer, network resource, etc.) and what permissions they have.

ACL allows system administrators and users to protect sensitive data and ensure that only authorized individuals can access specific resources.

NTFS Permissions

On NTFS disks, access permissions for files and folders can be configured. The available permissions are:

Viewing or Changing the ACL

1. Right-click the file or folder.
2. Select Properties from the menu.
3. In the Properties window, click the Security tab.
4. In the Group or user names list, select the user, computer, or group whose permissions you want to view or modify.

[ Right-click File/Folder ]
         |
         v
    [ Properties ]
         |
         v
    [ Security Tab ]
         |
         v
  [ Group or User Names ]
  +-------------------+--------+
  | User/Group        | Allow  |
  +-------------------+--------+
  | Administrators    | Full   |
  | Users             | Read   |
  | SYSTEM            | Full   |
  +-------------------+--------+

Alternative Data Streams (ADS)

In the world of NTFS file systems, Alternative Data Streams (ADS) act like hidden compartments within files. NTFS allows files to have more than just the visible regular data.

Legitimate Uses

Applications can use ADS to store:

• Metadata such as thumbnail previews or document summaries for images.
• Non-critical information associated with a file.
• Security information about downloaded files.
• Information about where the file was downloaded from (the Zone.Identifier stream).

Security Risks

While ADS has valid uses, it can also be misused. Malware can exploit ADS to hide malicious code within a file, making it challenging to detect using traditional methods.

visible_file.txt                  <- Normal data stream
visible_file.txt:hidden_stream    <- Alternative Data Stream (hidden)

Shadow Copy

Shadow Copy is a feature in Windows that allows you to create and store a copy of a file or folder at a specific point in time. This helps you restore files or folders if you accidentally delete or modify them.

The Volume Shadow Copy Service (VSS) coordinates the required actions to create a consistent snapshot of the data to be backed up.

Volume Shadow Copies are stored in the System Volume Information folder on each drive that has protection enabled.

What You Can Do with VSS Enabled

If VSS is enabled (System Protection turned on), you can perform the following tasks from Advanced System Settings:

• Create a restore point
• Perform system restore
• Configure restore settings
• Delete restore points

Important Security Note

Shadow Copy is not a substitute for offline backups and does not protect against ransomware. Malware writers are aware of this Windows feature and write code to find and delete these shadow copies. Doing so makes recovery from a ransomware attack impossible unless you have an offline or off-site backup.

[ Ransomware Attack ]
        |
        v
[ Encrypt user files ]
        |
        v
[ Delete Shadow Copies via VSS API ]
        |
        v
[ No recovery possible without offline backup ]

Summary

Windows has evolved through multiple file systems — from simple FAT to the robust NTFS. NTFS remains the foundation of modern Windows storage, providing journaling, granular permissions via ACLs, encryption, compression, and large file support. Features like ADS and Shadow Copy add powerful capabilities but also carry security implications that administrators and security professionals must understand.