I need to detect that a file has been copied from one thumb drive to another. The programming Language is VBA (WWB-COM) on a Win CE machine. In order to do so, I need to look at what could possibly change.
So far I have tried with these options:
USB Disk name: another disk will have a different name, so I know it's not the original USB stick. This works fine on normal systems, but in CE 6.0 the usb drive is renamed to "Hard Disk2".
Date file modified: this value is not changed if I copy the file from one disk to another. The only value changed is "Date file created" but this is not accessible without using FSO, which is not available on CE 6.0.
What could be something I can check through VBA that tells me that the file is not the one I am expecting?
--------ADDITIONAL INFORMATION---------
since this sticks use non-standard disk size, an option would be to retrive the size of "Hard disk2". but i was not able to find out how to do it..
here is the reference to all comands: http://www.winwrap.com/web/basic/language/?p=doc_group_overview.htm&menu=yes
Related
I want to find out which types of files are associated with Microsoft Word on my System. All these file types should be handled in a special way by my application. How do i get a list of all files types that are associated with an application like Ms-Word? I know there is a dialog to set the default programs. But there is no entry for Ms-Word and i need a mapping in the other direction. I am not sure if this is a programming question at all. This is what I need:
Ms-Word:
.docx
.doc
.odt
That takes a slog through the registry that's not guaranteed to be unambiguous. Startup Regedit.exe to follow along, open the HKCR hive and look at the registry keys whose name starts with . Quickest way to find relevant ones is by using Edit > Find and type "word".
First one you are likely to find is .doc. Note the default value of the key, that's the ProgId. It is "Word.Document.8" on my machine, I have Office 2013 installed.
The ProgIds are registry keys themselves. Navigate to HKCR\Word.Document.8 to see what it looks like. Expand the node to see the sub-keys, the one that matters is CLSID. It is "{00020906-0000-0000-C000-000000000046}". That has been the guid for Word for the past 20 years. Whether it will be for the next 20 years is anybody's guess.
You can continue to search but the fidelity start to drop off. The CLSID is a registry key itself, you can find it back in HKLM\SOFTWARE\Wow6432Node\Classes\CLSID. The LocalServer32 subkey's default value contains the path to the executable. "C:\PROGRA~2\MIF5BA~1\Office15\WINWORD.EXE" on my machine. A short name in MS-Dos 8.3 format, yours is pretty likely to read differently.
So, for now, I'd recommend to go from HKCR\.ext => HKCR\ProgId\CLSID and compare with the anointed guid. It is likely to work for a while, not forever. Hard-coding the extensions isn't terribly wrong either. Do note the ambiguity you'll discover when you search, filename extensions like .htm, .pdf, .xml can be opened with Word as well but is not the default association. And some are not documents, like .wll
Thanks i did find another workaround. At my german version of windows i search for "Dateityp" or "file association" and selected "Dateityp immer mit einem bestimmten Programm oeffnen" or "Make a file type always open in a specific program". The dialog shows the file types mapped to programs. Then i just collected the types that are mapped to Ms-Word.
I'm trying to rename a log file named appname.log into the form appname_DDMMYY.log for archiving purposes and recreate an empty appname.log for further writing. When doing this in Windows 7 using C++ and either WinAPI or Qt calls (which may be the same internally) the newly created .log file strangely inherits the timestamps (last modified, created) from the renamed file.
This behaviour is also observable when renaming a file in Windows Explorer and creating a file with the same name quickly afterwards in the same directory. But it has to be done fast. After clicking on "new Text File" the timestamps are normal but after renaming they change to the timestamps the renamed file had or still has.
Is this some sort of Bug? How can I rename a file and recreate it shortly afterwards without getting the timestamps messed up?
This looks like it is by design, perhaps to try to preserve the time for "atomic saving." If an application does something like (save to temp, delete original, rename temp to original) to eliminate the risk of a mangled file, every time you saved a file the create time would increase. A file you have been editing for years would appear to have been created today. This kind of save pattern is very common.
https://msdn.microsoft.com/en-us/library/windows/desktop/ms724320(v=vs.85).aspx
If you rename or delete a file, then restore it shortly thereafter, Windows searches the cache for file information to restore. Cached information includes its short/long name pair and creation time.
Notice that modification time is not restored. So after saving the file appears to have been modified and the creation time is the same as before.
If you create "a-new" and rename it back to "a" you get the old creation time of "a". If you delete "a" and recreate "a" you get the old creation time of "a".
This behaviour is called "File Tunneling". File Tunneling is allow "...to enable compatibility with programs that rely on file systems being able to hold onto file meta-info for a short period of time". Basically backward compatibility for older Windows systems that use a "safe save" function that involved saving a copy of the new file to a temp file, deleting the original and then renaming the temp file to the original file.
Please see the following KB article: https://support.microsoft.com/en-us/kb/172190 (archive)
As a test example, create FileA, rename FileA to FileB, Create FileA again (within 15 seconds) and the creation date will be the same as FileB.
This behaviour can be disabled in the registry as per the KB article above. This behaviour is also quite annoying when "forensicating" Windows machines.
Regards
Adam B
Here's a simple python script that repro's the issue on my Windows7 64bit system:
import time
import os
def touch(path):
with open(path, 'ab'):
os.utime(path, None)
touch('a')
print " 'a' timestamp: ", os.stat('a').st_ctime
os.rename('a', 'a-old')
time.sleep(15)
touch('a')
print "new 'a' timestamp: ", os.stat('a').st_ctime
os.unlink('a')
os.unlink('a-old')
With the sleep time ~15 seconds I'll get the following output:
'a' timestamp: 1436901394.9
new 'a' timestamp: 1436901409.9
But with the sleep time <= ~10 seconds one gets this:
'a' timestamp: 1436901247.32
new 'a' timestamp: 1436901247.32
Both files... created 10 seconds apart have the time created-timestamp!
Is there any way to create a boot-able USB from a windows DVD via command line?
It is accepted using third party application which accepts command line arguments.
I searched internet but did not found any way.
You can do this using the program diskpart which is included in windows.
You need the following steps:
SELECT DISK <DRIVE NUMBER>
CLEAN
CREATE PARTITION PRIMARY
SELECT PARTITION 1
ACTIVE
FORMAT FS=NTFS QUICK
ASSIGN
EXIT
save them in a txt file. Find out the drive number using "LIST DISK"
You can then call diskpart with the /s parameter and give the saved textfile as a script.
Afterwards you can copy the content of the dvd over.
Now as to really do this programmatically:
The main difficulty would be selecting the correct drive number in case it may vary.
The main problem however is that this is a pretty dangerous operation. If you select the wrong disk (as stated those drives are selected by number not even by their drive letter) instead of your usb drive you might format a partition of your harddrive. I would personally not really fully automate the task but rather do it by hand.
It is exactly wnat the title says I have beenlooking for quite sometime and haven't found anything the main use would be as a auto run file to collect error reports from our offic computers
You could do this if you run the program from the USB drive itself, and declare wherever the file is stored as the "working directory" as the USB may have different IDs for different computers...things get messy.
My recommendation is to use File in Java, and Path (http://docs.oracle.com/javase/7/docs/api/java/nio/file/Path.html)
A warning though is that if you copy a directory (folder), the files within that folder are actually not automatically copied...its just the way it works. (more here: http://docs.oracle.com/javase/tutorial/essential/io/copy.html)
Assuming the file is always in the same place going to the same place. For example:
Files.copy(source, destination, options);
or you can open text file and read from it for a more advanced method:
Files.copy(InputStream, path, options);
etc.
I know FAT32, as well as FAT16/12 neither support symbolic links nor hard-links. However I came up with this idea:
The FAT specification describes that every file is associated with a directory-entry. In my understanding, one could say that a file-entry in a directory somehow or other points to the file's content.
So, how can I define two directory-entries which point to the same file-content? Or, what could prevent me from doing so?
Use case: I have a USB mass storage device for my car radio, and I want to use directories as playlists since the radio software doesn't support playlists. So it isn't important to me how Windows behaves when doing this.
This should work for simple issues. I.e. it works as a hack / workaround and I don't know what happens if you rename / move / remove files. So, you should not do this on your main hdd.
I edited the directory-entries manually using a hex editor. I modified clusters as well as file-sizes and successfully faked hardlinks. My car-radio and even Windows (7, 64Bit) have no problems with playing back the original and "hard-linked" mp3-Files I used.
When I'm opening the device again in the hex-editor none of my modifications are changed back (See chkdsk issue in answer #1 - but as far as I know chkdsk has to be started manually, anyways.
What you are talking about ("two directory-entries which are pointing to the same file-content") are hard links. chkdsk will report them as cross-links and break them, "repairing" the files (in fact making the copies).
MichaelPh posted instructions on SuperUser:
https://superuser.com/a/486829/51237
It's possible to use Disk Probe (on XP only, I've yet to get it to write the changes on Win7) to modify the cluster a FAT Directory references. This method can be used to redirect the DCIM folder (or a subfolder) to point to the folder used by a different scan device.
Whether this is a good idea or not is a different matter and you use this at your own risk.
Insert the Eye-Fi card either in it's USB Card Reader or directly into an SSD slot and note the drive letter it's installed as (assumed to be F:\ for simplicity)
Ensure all Windows Explorer windows for the card and sub-directories are closed.
Run Disk Probe
Select Drives->Logical Volume
In the Open Logical Volume dialog double-click F:\ in the Logical Volumes list
Click the Set Active button for the Handle F: has been selected as. You can leave the handle as read-only for now.
Select Tools->Search Sectors...
Check Exhaustive Search, enter DCIM in Enter characters to search for and Search
You should find a match (mine is at 8192). Select No on the "Found match..." dialog to cancel the rest of the search.
Select Sectors->Read and increase Number of Sectors to at least two so that the whole directory table is included.
Find DCIM in the ASCII on the right of the Disk Probe screen, this is the start of the FAT entry for the directory. Make a note of the hex value of the 27th byte of the record (each entry is 32bytes), this is the directory cluster reference. This value is require to revert the DCIM directory back to normal use if required.
Find the entry for the directory you want to redirect DCIM to and again make a note of the 27th byte in the record.
Go back to the 27th byte of the DCIM record and change it to the value noted in step 11.
Select Sectors->Write and then click Write it on the Write Sector dialog. A warning will come up if you opened the sectors as read-only. Yes to overwrite if you're happy to make the change.
Opening the DCIM directory in Windows Explorer will now show the contents of the target directory.