chuckles I inspected the vmx file for a computer fornsics assignment to see what files get loaded and... looks like my lecturer used a pirated version of windows

@JourneymanGeek Nice. Though I hear that pirated copies of Windows are common in Asia...

@sidran32: australian university ;p

@JourneymanGeek Oh well. Still amusing. :P

I'd say pirated copies of Windows being commonplace is independent of geography

ffff

Apparently i'm expected to boot the suspect image

and possibly install software on it

I'm going to check. its bad practice

There's also a mysterious linux frugal install i can't seem to find a boot method for

@sidran32: eheh. Also, about the Das... honestly, ANYONE who has ever used a mech keyboard will never EVER EVER go back to crappy membranes ;p

has his BW ultimate set up on the dell

:P

One of these thing just aint like the other. I am sure someone here can answer this question more definativly , I swear I am reading it right? but mabey not. 2 data chunks linked from Microsoft, 100% reversal of the direction of links

All of the components in the operating system are found in the WinSxS folder – in fact we call this location the component store. Each component has a unique name that includes the version, language, and processor architecture that it was built for. The WinSxS folder is the only location that the component is found on the system, all other instances of the files that you see on the system are “projected” by hard linking from the component store.

blogs.technet.com/b/askcore/archive/2008/09/17/…

In practice, nearly every file in the WinSxS directory is a “hard link” to the physical files elsewhere on the system— meaning that the files are not actually in this directory. blogs.msdn.com/b/e7/archive/2008/11/19/…

@Psycogeek, are found in is still true even though they are hardlinks...

@soandos I just need to know 2 things, where are the actual File items themselves? and which one of the statements should be concidered fully correct?

@Psycogeek, both statements are correct, and just examine the hardlink. Why do you need to know out of curiosity?

I need to know so i dont talk out my butt. and I want to know the actual location of the files.

So i am seeing things? when it says the WinSxS folder is the only location the component is found, and the other blog says the files are NOT in the WInSxS directory ?

I just ran the nirsoft NTFSLinksView utility on the Windows and Winsxs folders and it found no links (and then ran it on c:\users to make sure it wasn't a false negative)

@Paul so that means the component store is the component store ? right?

@Psycoge Umm, there is always the chance I am missing something, but to me it looks like the files in Winsxs are actually in Winsxs

@Paul If you happen to still have it running, and ran it on the system32 folder, the files in there are "projected" by hard linking from the component store?

I am running a full scan right now, so that will include system32 - but I did one previously and didn't see any links. So either neither description is correct, or I am missing something

Well I know one thing, the Systems reported space usage for the WinSxS is larger than its reality. And i certannly believe them when they say that it is not as large as it seems.

but my loose math here shows about 2.5Gig , should be in it. which seems relative to the size of the DVD that gets installed there?

This pic shows my system. 13 gig max size disk, the cluster view shows that most of it is used up.

the normal disk size thing, showing that there is ~12g of used space. The All files count which is WRONG, because there could not be 16G used on a 13G drive, and the file count, on the SXS which is also wrong.

Adding up all the Other files (approx) other than the SXS ammounts to ~9.2G

Ok, I did an infinite depth scan from c:\ and all it found were the standard junctions from c:\users -> c:\documents and settings (and the links within), and c:\program data -> c:\users\all users

@Psycogeek Definitely no compressed files?

None that i know of, I have tried to avoid that so far. there might be a couple of zips.

@Psycogeek A zip would just be a file, I was referring to NTFS compression

right, no compression has been applied yet. this is sort of a fresher install, only 64 programs on it now, and the drivers.

none of the big pig programs are there yet because i have to get everything else straight and Image it again. It also is expandable partition (space avilable), it is not actually running out of space. it is just partitioned this way for viewing.

here is another view, same disk but long ago, i.sstatic.net/RV2Oo.jpg The dk Green is what the Disk defragger tagged as being the WinSxS

Done

I found a utility called hardlink_scanner

It looks like the nirsoft utility cannot see hardlinks, only junctions and symbolics

ahh, that makes sence.

If I run hardlink_scanner it tells me that the winsxs folder contains many hard links

Phew

It is interesting, because the article suggests that the files "aren't actually in winsxs but are links from elsewhere in the file system". Of course, that doesn't make sense with hardlinks - the file is not in either folder specifically, each hardlink is equal

So it makes just as much sense to say all the files are in Winsxs, but with hardlinks from elsewhere

Ohhh, so everything is a hard link, and the one file is on the disk?

That phrasing only works with symbolic links - where there is a true file, and links to ti

Yeah

Even a file with no "hard links" has one hardlink

the original one in the MFT?

If you create a second hardlink to the file, then deleted the first hardlink, it is the same as "moving" the file - the file never gets moved, it is just changed in the mft

Yeah

Deleting a file in Windows is the same as deleting a hardlink. Once the hardlink count is zero the space is freed.

Hmm

Perhaps it isn't that simple, but it seems this is the best way to visualise it

perhaps that is why MS described it that way. I think you figured it out for me, which just leaves the "install disk" the original install, those files should not have multiple hard links?

Ughh, why the heck are we talking about where a file is "located" in the context of hardlinks??

It's a link. It's located on the drive. Period.

End of discussion.

Destroy the last link. The file magically disappears??

Nope, still located on the drive. That's how you can undelete a file.

@surfasb Thanks for the confirmation.

I'm gonna try moving the Installer folder.

That makes more sense, than moving something used as often as the WINSXS folder.

@surfasb the whole thing starts back at the MS links, where MS tries to descibe "where" the stuff is located. and Paul helped me out bigtime, i mentally can adopt to it now.

@Psycogeek Ah, k.

While it is commendable to see ppl try to squeeze their OS onto a 40GB drive, I'd rather they not spread horsecrap while they do it.

That leaves only wanting to know One thing, There is an Install disk, on the system, Its files should not have "multiple hard link counts"?

Man, I'm trying to remember if I've ever owned a 40GB harddrive.

@surfasb Well check out the links, it was MS spreading the horscrap

@Psycogeek Technically, MS is right.

It does live in the WINSXS.

50% of the sites out there are using blog 1, and the other 50% using blog 2

It also lives where ever the hardlink is.

@surfasb smarty :-)

They are all on one drive.

Actually, the files get placed inside the WinSxS folder first.

And then are hardlinked to from the other places.

Of course it is already a hardlink in the WinSxS folder...

@TomWijsman Yeah, I suspected as much, it would seem odd to do it the other way around even if ultimately it ends up as the same setup

...but that's what they mean with that they reside there.

@Psycogeek It's just they didn't go into the nitty gritty about how Explorer doesn't display the correct folder size.

@surfasb that is the only thing they were trying to say, "dont look dont touch, it doesnt exist"

@TomWijsman Yeah the issue earlier in the thread is that they describe it both ways "reside elsewhere, links in winsxs" and "reside in winsxs, links elsewhere"

@Psycogeek That's because folder sizes aren't what you think they are.

Folders don't have sizes. Files do.

They are hardlinks, so it doesn't matter, but the inconsistancy in describing it just confuses a straightforward principle

@surfasb I wasnt even looking in the folder size originally, i was looking at the disk cluster size

@Psycogeek But you have to look at it per file. Any time you start grouping a bunch of files into a folder, the math is wrong.

@Psycogeek: By the way, remember our little convo:

@Psycogeek I would also use Mydefrag. In order for a program to determine the file's cluster count, it needs access to it's MFT entry.

@TomWijsman YEs and how easily it would have been to understand that If i didnt have the assistance of MS saying it is Here and not there, and then 100% reversing that.

Or just use the included Win32 calls. I'm not exactly sure which ones need Admin access though.

Yeah, if a folder has links to files with more than one hardlink, don't trust any folder sizes.

Ah, found it back:

Still wondering if anyone ever made that.

Is there a hard link count GUI :-)

Where does the Defragger Think the file is? in the first Hard link in the MFT it comes to?

There are Install files from the DVD, not all of them are installed, would these files have only 1 "hard link" ?

On the subject of links, if there is a symlink in a directory to a parent directory, how does explorer or anything else for that matter avoid getting trapped in endless recursion as it tries to enumerate all files?

scratch that, gotta say it correct. when the Defragger "sorts" the file based on its "folder location" which link does it use?

@Psycogeek I recommend you get Link Shell Extension. It not only puts icons on files with more than one hardlink, it can tell you also where the other hardlinks are.

@surfasb is it gui based? or CLI based?

@soandos There is a Win32 call that tells you if a file is a reparse point.

@Psycogeek It's a shell extension. GUI.

@surfasb Excellent

@surfasb, so it just ignores it if it is?

@soandos From there, it's just a matter of keeping track of where you've been. I forgot what the algorithm is called, but it's basically where you check if you've been down that branch before. Once you've been down all the branches, you are done.

@soandos Well, essentially yes.

@surfasb, thanks.

@soandos Makes me wish I went for a CS degree. Then I'd be all ninja with the algorithms and data structures.

But the business school had all the hot chicks, so I went with MIS.

@surfasb DFS (depth first search)

@surfasb Great Dling it. so on this thread superuser.com/questions/379607/… what did I F--up any worse than the accepted answer ?

@DanD Thanks. I need to start reading these CS books asap.

@DanD Then you still recursive infintely if all you do is a depth first search (as you never hit "bottom")

@Psycogeek I don't understand you.

I took CS but haven't been using the algorithms quite so much in my work. I was going around interviewing and you know, at the interview is the wrong place to start trying to recall long-lost information from school. :\

They'd ask me something, I'd think about it, give the wrong answer, they ask me to explain it, I think some more, and then I get that "aha" moment and realize what the right answer was. :o

@soandos Not really. You'll realize you hit a loop when the current folder matches the list of folders you've visited before.

@surfasb Nick said that the WinSxS folder is hundereds of megabytes at most, which is laughable via hundreds of analisis on the web , where people used hard link utilities

@soandos True, which is why you'd keep track of the visited nodes along the current path and not descend into them again. but that's just an addition to the base DFS process.

@Psycogeek Oh, I'm not sure about that part.

I probably should go back for a Master's degree...

morning

@surfasb Well i will get this Install going to look, then i will know more. but i was trying to just cover the INSTALL disk that resides somewhere around there.

Hi @Sathya

@Psycogeek Again, that's talking about folder sizes, which doesn't exist in this case. Any folder which contains files with more than one link doesn't have a size. The abstraction doesn't fit in that case.

@sidran32 hey

Hm. I should keep looking at that randpass tool I was working on...

@DanD I'm assuming there is a breadth first search. . .

@surfasb I'm pretty sure there is

@surfasb Yes, but it's not normally used on filesystems.

@sidran32 Yeah, I'm looking at it on wikipedia.

@surfasb Hurry up! :P

@surfasb so the Install DVD Files that exists on the disk has more than one hard link?

@DanD Interesting. My first instinct would be breadth first is faster.

@Psycogeek If you installed the LSE, then under properties it will show you the reference count.

@DanD I assume most users start their search from the node where they think it is.

Mathmatically, I have no idea.

Dangit... On occasion my computer just hangs... screen goes black, no response yet fans are still spinning, can't even use the motherboard's reset button or hold the power button to shut it off. Have to switch off the PSU. Faulty motherboard?

Like, this happened just now.

Actually, then fans would still be spinning since the motherboard isn't acting as the fan controller. But still. :P

Ah nm. Breadth first search and depth first search both have the same time.

They are both linear to the size of the graph.

@surfasb, as they should. Why would it be different?

@soandos Umm, I expected myself to be right :)

@surfasb, edited, sorry

@soandos That's a good point. They essentially use the same pattern. If I go depth first, it's the same as breadth if I flip that graph on its side.

@surfasb Correct, what matters is the space required to store the to-visit list. with DFS that space is the same as the path length, and can be stored as a stack.

@DanD Yeah, when I saw DFS uses a stack, Dan's comment made so much sense.

Knowing more about human psych than I do algorithms, I thought about it differently.

My thoughts were, "Well humans don't store crap in deep branches. On top of that, they usually want to search because they have no idea which branch to choose, not so much where in a branch is the item."

I know I'm reinventing the wheel, but I quite like how this tool is looking. This is fun :)

lol

@sidran32: might be PSU as well

@JourneymanGeek I doubt it's the PSU because it happens whenever, and it still is providing power to everything just fine, as far as I can tell.

@sidran32: well, i've had a similar thing happen when my PSU failed

Beware, I'm getting maker's pride again. :P

lol

Oh, @JourneymanGeek? What happened?

@sidran32: all fans working, mobo has 'power', but it didn't boot

i think it was my second system, a PIV

Oh, no, it boots just fine. It just hangs while it's running, with a black screen.

Flip the PSU off and back on and it boots just fine.

When it's hung, I can't use the mobo's power or reset button, which says to me potential motherboard issue

ahh

I'd warn

I assume everything is a PSU issue first ;p

:P

the place i live in is murder on them

Uh huh.

same reason i'd like to have a 5 year cycle on systems

thats around the point things. start. failing

That sucks

Is it because of fluctuating power levels from the wall?

>_>

only if you live in a third world country

there's devices that compensate for that tho

I have no idea what Singapore is like!

:P

lol

well

It also could just be a sucky power company. :P Our old AMD office was plugged into a crap one that had a tendency to give us brown outs. :P

we have very reliable power... so far...

Heh, our server farms had UPS backup. Just the desktop systems didn't.

Though when I got a Linux box for my cubicle, they did give me a UPS since they were kinda intended to be "always on" and IT didn't want to support them officially :P

@surfasb Ok got the link extention showing Little Red arrows on "files that have more than one link" ? and in the properties they show having more than one hard link.

@sidran32 I get brown outs when i turn a vacuum (or other like device) on or when others in the building do; which is why i got a UPS, but its turned out to be nice to have on a number of occasions also considering that i leave my computer on and my laptop has clocked over 540 days on (although not consecutive)

@surfasb With the link extention tool the files with No little cute arrow, have no extra links "Those files reside in that actual location & only there" ?

@DanD A brown-out is when the power goes completely out for only a few seconds. I do see the lights dim when the refrigerator's compressor kicks in and stuff but it doesn't do anything to my computer.

Unless you mean turning a vacuum on actually kicks the power out for a few seconds, which is odd :o

@sidran32 well, by brown out i mean any drop in power voltage. i.e. lights dim. what your calling one is just a momentary black out. when the voltage drops to zero.

I think i have had two power outages... in 20 years

one was building only

in the other the power station caught fire

@DanD That's what I figured.

@JourneymanGeek The power station should have had backups in anticipation of that. :P

@sidran32: which prolly also burnt down

they managed to switch over after two or so hours

@JourneymanGeek And they didn't anticipate that either?? :O

Its not like you can flip a switch

1/3 of the local power generation capability was out

2 hours isn't very long in that case

@JourneymanGeek I'm joking that they didn't have anticipate their backups catching on fire. :P

They should have written an exception handler for the "Disk On Fire" exception.

@Psycogeek Yeah.

@surfasb thanks, so now it is pretty obvious what I (myself) can toss out.

@Psycogeek Good luck. I'm gonna try moving the Installer. Makes more sense IMO.

There are the 27 language repetition items, i only need 1, and other various things not installed that I will not ever install, Those might break a Update though :-(

@surfasb Yes much safer , even if it lost any links, it could be put back

@sidran32: and an exception handler for the exception handler for the disk on fire exception being on fire?

@JourneymanGeek Yes! Good thinking!

and a exeption handler for the exception....

it would be like EXCEPTION!

Exceptional!

@Psycogeek I'm just weary of moving a folder that shows up as "System32" for 32 bit folders.

@surfasb Umm hey i am not awake enough for you to be throwing curve balls :-) the system32 folder in win64bit holds the 64bit files . then my brain explodes again

At first, it should work, since symlinks are implemented at such a low level.

Here is a good one.

for 32 bit programs, 64 bit dlls show up under SysNative.

holy crap. Command & Conquer in HTML5 & JS

@Sathya Holy crap!

thats pretty impressive

@Sathya Awwwww, it's not Red Alert. No Tanya :(

Is it possible to set up a solar-powered network where one can access all files on any computer connected to the network if they give access without use of the internet using a Wireless Bridge mesh (or whatever it would be called) ?

@JamesRoseman Given the right solar panels, networking equipment, and configuration, I don't see why not? I can't say I've seen something like that before, solar powered, anyway...

@JamesRoseman yes.

I just switched back to IE9 on my laptop, from Chrome. It's a good browser, but mainly because it looks better with my theming. Chrome just breaks when themed...

Lol google just put a black block on its logo to join the freedom protest.

@Psycogeek I know. Click it. :P

I like that. I was afraid they were going to just put a banner and a link on their site or something. This is a bit more visible.

Wikipedia is down, too. :)

i think they should pass it in congress, then get it Keeled by the supreme court (freedom of speech and unconstitional), then it will live like Roe-V-Wade forever ?

it would then become a "president" for other law cases, making them wisk right on though.

You mean precedent. However, the issue is that you can't immediately challenge the law in the Supreme Court unless it affects you somehow. Like, if they used it to take your site down, you could bring it up in court, and it would have to get escalated to the Supreme Court by the lower courts. Too much at stake to take that route.

What is at stake? those monkies get cut off from thier politico tweets and donations, they will cry louder than the rest of us.

some stocks they own will take a 30% dive and they will be crying to AlGore to make up a new internet :-)

What's at stake is whatever loss is felt after the law is passed but before any challenges make their way to the SCOTUS.

The Interns at the place wont have anything to do with them anymore , they will have to work OMG again.

@Psycogeek Sorry but I don't follow you.

They always have more to lose than we do.

Who is "they", "them", and "the place"?

They be the good ol boys at the top with the money and power.

@JamesRoseman You had a question about this didn't you? WDS is an option as well as the repeater bridge option in the answer. If you google dd-wrt wds the first link shows you the various options supported by dd-wrt, which is a very flexible OS for domestic wifi routers

I installed dd-wrt on my router. Made my wifi connection actually be reliable instead of cutting out all the time and eventually having to reboot the router manually about once a week. :)

Still have to reboot now and then but at least I can schedule it to reboot automatically and at night. :P

lol

@sidran32: my DD-WRT router is a little too soild

I should be sleeping. But I'm watching everyone post about SOPA on facebook and stuff :P

I didnt have to go to harvard, to see a great Natzi ploy. It is brilliant. Were going to take away your freedom unless you help us find and kill all the bad people. Then the people all jump around and start turning eachother in :-)

@Psycogeek: actually also happened with mcarthy

@sidran32: apparently my law minister thinks sopa is brilliant

he's an idiot

@JourneymanGeek It's a brilliant piece of crap. :P

@sidran32: apparently they love intellectual property protection soooo much

for a country that can't innovate

Heh

@JourneymanGeek Ok that works :-) McCarthyism drove hundreds of thousands of trade unionists, peace activists, communists and free-thinkers of no particular ideology at all into isolation and poverty. It destroyed the lives of those witch-hunted, and intimidated millions of others into “keeping their heads down” and their mouths shut.

@Psycogeek: and that is how all this intellectual property protection feels like

they move the goalposts, then complain that it wasn't moved far enough

Ok, another reason why I should use IE9-- the ad blocking plugin I have on here is far faar faaaar superior to anything Chrome can do.

o0

It wasn't free but man is it worth it :P

wait

you paid for adblock?

lol

No, not adblock

ahh ;p

what wasn't free then?

Its free version has a limited number of blocks.

Per day, that is

It was worth it, going from the unblocked raw version of pocketnow.com to the blocked version of pocketnow.com. It's finally usable!

lol

ahh cellphones

Yes. :P

Their webmaster needs to be run over with a horsedrawn carriage.

So much flash, so few resources...

looool

And at the end of the McSopa era , the internet will be fully "cleansed" of all the rif raf, and "The One" will have control of the whole thing. the Gov-o-Corp the one single all encompasing corporation goverment combinations.

BUGGY CART HIM!

@Psycogeek: I think the problem is, lots of corps would prefer something closer to the old walled garden, rather than the vaguely organised anarhy the internet is

funny thing is, lots of old timers wouldn't mind if the riffraff and the corps were in a walled garden ;p

well and governments

I think we need a cloud net, no Bigger a SkyNet :-)

mine is basically struggling to work out a new strategy in an era when people can actually shock pull up old things they said, and point out when they make mistakes AND be heard

@JourneymanGeek AirPlay and Raspberry Pi

I want to know what video player they are using ;p

doubts clippy knows, being a spawn of microsoft

DUDE. The cables coming out of the thing are comically larger than the board itself! :D

lol

@sidran32: its awesome

Wait you can buy Raspberry Pis now??

the prototypes were even more comically smaller

@JamesRoseman: soon, they're in production

ARGH I want one so badly haha.

I might get one for my birthday if i got enough money left over after paying off my annual hosting bills

I'd love to buy a ton, put them in weatherproof cases with solar panels, and hire friends to help assemble a ton then create a mesh network at my campus.

@JourneymanGeek He's running airplay-nmt

@sidran32: ahh. they also have another video player then

ahh, its custom :/

I asked a question about networking and somebody said that they were in the process (or wanted to? I forget...) take a DS and gut it, use the SanDisk port and configure a wireless extender, and make it weather/tamper/shock-proof. Then throw it on the roof of Starbucks and extend their free internet haha.

I really think an x-less video player would be ace ;p

sandisk port?

why take a DS?

I have no idea.

Probably just had a bunch lying around.

@JourneymanGeek I think mplayer can be an x-less player.

I'm fairly certain I used it without X before...

This was years ago though

for video?

i'll need to try this

I think so. :P

Also...

ah hah!

Oh god haha!