dslreports logo
 
    All Forums Hot Topics Gallery
spc
Search similar:


uniqs
1285

Cartel
Intel inside Your sensitive data outside
Premium Member
join:2006-09-13
Chilliwack, BC

1 edit

Cartel

Premium Member

[WIN7] What are these folders?

Click for full size
Click for full size
[DELETED]
[SYSTEM]
$Extend

All my drives have these folders...I used 7zip as admin and clicked \\.\ and browse my volumes and they all have the folders and the [DELETED] folders have my "deleted" files.

norwegian
Premium Member
join:2005-02-15
Outback

norwegian

Premium Member

Wiki will answer enough for the $extend

»en.wikipedia.org/wiki/NT ··· etafiles
dave
Premium Member
join:2000-05-04
not in ohio

dave

Premium Member

Though it's curious (a) why it's visible, or (b) why it's the only metadata file that is visible.
dave

dave to Cartel

Premium Member

to Cartel
I don't see those.

What is 'B:'? Unless you've intentionally used it as a fixed-disk drive letter, that's usually a floppy.

Have you run any 3rd party volume management tools on these disks, for example deleted-file recovery programs?

norwegian
Premium Member
join:2005-02-15
Outback

norwegian to dave

Premium Member

to dave

I'm seeing the same on my computer with 7-Zip.

There are plenty of files contained within $Extend, $Txflog, $Txf, $Repair etc.

[SYSTEM] has the usual $AttrDef, $MFT, $Boot, $BadClus, $Secure:$SDS etc.

To me they are all standard entries?

mmainprize
join:2001-12-06
Houghton Lake, MI

mmainprize to Cartel

Member

to Cartel
I think this is a 7-ZIP thing and you should be looking in a 7-ZIP forum as to why the program shows these folders.

Many of the folder are hidden system folder and it looks like 7-ZIP may show a different name in some cases.
dave
Premium Member
join:2000-05-04
not in ohio

dave to norwegian

Premium Member

to norwegian
Then I suspect [SYSTEM] is an invention of 7Zip. AFAIK, $Mft, etc, are either not catalogued in any directory, or they're catalogued in the root directory. Maybe 'file not in directory' is too weird for 7Zip's mind

Still, I thought those things were generally invisible unless a filesystem debug switch was enabled. But as suggested elsewhere, perhaps they're only invisible via the Windows API, not the native API.

I have no idea what [DELETED] is; there's no corresponding NTFS construct that I know of. Can 7Zip do disk scavenging?

Exidor
Premium Member
join:2001-05-04

1 recommendation

Exidor to Cartel

Premium Member

to Cartel
From the 7-Zip File Manager Help document:

You have access to the following items from root folder in 7-Zip File Manager:

* Computer: computer's disks

* Documents: My Documents folder of current user

* Network

* \\. : the folder for low-level access to disks. You must have administrator's rights to use that folder. You can

* copy .iso images from CD/DVD to file.
* view NTFS/FAT partitions via 7-Zip parser. It provides read-only access to files including recently deleted files in NTFS partition via [DELETED] folder.