Alterations to files stored on my server?

Got questions or helpful tips/tricks? Ask here!
Post Reply
johnb
Posts: 3
Joined: Sat Mar 03, 2018 7:38 pm

Alterations to files stored on my server?

Post by johnb » Sat Mar 03, 2018 7:30 pm

Does Integrity Checker alter data within files on my sever? Where are the hash stamps stored?

TIA!

sarah (electrongoo)
Posts: 44
Joined: Wed Feb 28, 2018 9:39 pm

Re: Alterations to files stored on my server?

Post by sarah (electrongoo) » Sat Mar 03, 2018 7:30 pm

File data, modified date, creation date, and attributes are always preserved by Integrity Checker. Hash information is stored in the files alternate data stream.

Integrity Checker stores the SHA1 hash in the alternate data stream of the file. But, since the size of the SHA1 is small (about 200 bytes), it is typically stored in the file systems MFT (Master File Table) and does not consume its own data cluster. Note, it is "typically" stored in the MFT. If there are numerous alternate data streams attached to a file then they could be pushed out of the MFT and made non-resident; in which case the data stream will consume a cluster. But his is NOT typical and generally does NOT consume an entire extra cluster.

Sarah

Post Reply