From: nospam@needed.invalid   
      
   On Fri, 6/6/2025 3:28 AM, Lawrence D'Oliveiro wrote:   
   > On Thu, 05 Jun 2025 20:55:42 +0200, lisa wrote:   
   >   
   >> I'm familiar with windows hidden files and I know Linux also use them.   
   >   
   > Different mechanism. Windows has an attribute to mark any given file/   
   > directory as hidden. On Linux (and *nix systems generally), there is no   
   > attribute, the convention is not to include files/directories with names   
   > beginning with a dot by default in directory listings.   
   >   
      
   File attributes can be checked (NTFS) one file at a time, like this:   
      
      fsutil usn readdata Y:\Windows\Logs\CBS\CBS.log   
      
   "The following attribute values are returned by the GetFileAttributes   
   function:"   
      
   FILE_ATTRIBUTE_READONLY = 1 (0x1)  \   
   FILE_ATTRIBUTE_HIDDEN = 2 (0x2)     \___ legacy assertions, visible as in   
   cmd.exe  "dir /ah" for hidden   
   FILE_ATTRIBUTE_SYSTEM = 4 (0x4)     /   
   FILE_ATTRIBUTE_DIRECTORY = 16 (0x10)   
   FILE_ATTRIBUTE_ARCHIVE = 32 (0x20)   <--- ( File system features causing   
   excess SSD wear, may be suppressed )   
   FILE_ATTRIBUTE_NORMAL = 128 (0x80)   
   FILE_ATTRIBUTE_TEMPORARY = 256 (0x100)   
   FILE_ATTRIBUTE_SPARSE_FILE = 512 (0x200)    <--- Windows supports Sparse   
   files, but the tools for it are poor.   
   FILE_ATTRIBUTE_REPARSE_POINT = 1024 (0x400)    <--- the Paragon driver in   
   Linux, is getting better at parsing reparse points   
   FILE_ATTRIBUTE_COMPRESSED = 2048 (0x800)         <--- old compression, as new   
   compression is a reparse point   
   FILE_ATTRIBUTE_OFFLINE = 4096 (0x1000)   
   FILE_ATTRIBUTE_NOT_CONTENT_INDEXED = 8192 (0x2000)   
   FILE_ATTRIBUTE_ENCRYPTED = 16384 (0x4000)        <--- old compression and   
   encryption show as "colored" files in explorer   
      
   C:\users\paul\.gimp-2.6   <=== dot files can exist in Windows, but are   
   visible, hiding a file is an Attribute   
      
   desktop.ini  can be seen in many folders, by using "dir /ah".   
   At GUI level, you can set File Explorer to display hidden files such   
   as desktop.ini as a default.   
      
   Contents of "desktop.ini" in the Music folder. The shell32 references can be   
   entry point numbers.   
   The usage of a non-existent entry point value is a "hint" of potential malware   
   presence (seen on WinXP),   
   it could exist if the pest has been removed. Similarly, TrustedInstaller   
   registry entries can be   
   left by malware, and AV products do not remove them for you (nuisance!   
   detected!).   
      
   [.ShellClassInfo]   
   LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21790   
   InfoTip=@%SystemRoot%\system32\shell32.dll,-12689   
   IconResource=%SystemRoot%\system32\imageres.dll,-108   
   IconFile=%SystemRoot%\system32\shell32.dll   
   IconIndex=-237   
      
   Even the filesystem at rest, no longer has to have consistent metadata. Maybe   
   a $BITMAP   
   has to be computed while the file system is being mounted by the mounter.   
   After the lazy   
   evaluated characteristics of the filesystem are computed, the file system can   
   then be   
   open for service. This was apparently added as a "feature" for reducing SSD   
   wear (somehow).   
   Even the partition size computation, for a time in Windows, was wrong. Many of   
   these   
   issues, temporary ones, aren't documented.   
      
      Paul   
      
   --- SoupGate-DOS v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)