Page 1 of 1

Alterations to files stored on my server?

Posted: Sat Mar 03, 2018 7:30 pm
by johnb
Does Integrity Checker alter data within files on my sever? Where are the hash stamps stored?

TIA!

Re: Alterations to files stored on my server?

Posted: Sat Mar 03, 2018 7:30 pm
by sarah (electrongoo)
File data, modified date, creation date, and attributes are always preserved by Integrity Checker. Hash information is stored in the files alternate data stream.

Integrity Checker stores the SHA1 hash in the alternate data stream of the file. But, since the size of the SHA1 is small (about 200 bytes), it is typically stored in the file systems MFT (Master File Table) and does not consume its own data cluster. Note, it is "typically" stored in the MFT. If there are numerous alternate data streams attached to a file then they could be pushed out of the MFT and made non-resident; in which case the data stream will consume a cluster. But his is NOT typical and generally does NOT consume an entire extra cluster.

Sarah