Combined sparse and compression flags

[Szeraax]

You asked this question:

Does the sparse flag needs to be set for sparse compressed files?

Now, I'll fully admit that I'm a dummy, but I only saw the flag for the sparse/compression/encryption in the $Data attribute. If that is the ONLY place that one should be looking to see if file is sparse or not, then I an answer your question accurately. However, everywhere that you have stuff as 0x4000 and 0x8000, I see the actual bytes as 00 80 (0x0080) for sparse and 01 00 (0x0100) for encryption, etc. So, if you understand what I'm talking about, then maybe you will find use in what I've dug up tonight:

The answer is yes. A sparse + compressed file shows up as 0x0180 (Both sparse and compression flags set).

In this case, the sparse file has 64kb allocated, but the disk usage is reduced to 4kb due to compression:

---

A non-sparse file that gets encrypted sticks with just 0x0040.

I can also confirm that a sparse file (0x0080) that is then set to encrypted shows up with $DATA attribute flag set to 0x00C0.

Filed as an issue because I don't know if this is useful or accurate. Good luck!

[joachimmetz]

@Szeraax thanks for sharing your observations any way to reproduce this scenario so it could be added to https://github.com/dfirlabs/ntfs-specimens

[Szeraax]

I use $MFTBrowser to view the records. In my testing, it always just shows the bytes the same as if I print them raw to console. Here are my results from it:

If a file is compressed, the attribute flag will be set to 0x0100:

If a file is encrypted, the att flag will be set to 0x0040:

In order to test these same flags out with a sparse file, you must first create a sparse file under this patterns:

You must create a file, then set it to sparse mode, then tell it what range to mark as unwritten 0s that can be safely ignored. Like so:

# powershell:
fsutil file createnew .\sparsefile.txt (1mb)
# File <>\sparsefile.txt is created
fsutil sparse setflag .\sparsefile.txt
# Write some data in hxd and save it (which saves the whole file)
fsutil sparse setrange .\sparsefile.txt 16 (1mb)
# Now the first 16 bytes aren't sparse, but the rest is.

Att of sparse file is 0x0080:

Att of sparse and compressed is 0x0180:

Att of sparse and encrypted file is 0x00C0:

Does that help?

[joachimmetz]

Does that help?

thanks, yeah that gives me enough context to try to recreate a test file

[Szeraax]

I suspect that maybe these flags are all set to have a padding byte and so the little endian is just looking wrong to me, despite being all well and dandy.