How to determine whether a file is protected operating system file?

[Yashied]

How can I determine that a specified file is protected by the operating system?

Thanks.

[guinness]

Maybe FileGetAttrib() could help?

Edited February 25, 2011 by guinness

[Yashied]

Maybe FileGetAttrib() could help?

No. For example, see C:\autoexec.bat. Edited February 25, 2011 by Yashied

[UEZ]

Probably all files with system and hide flag.

With attrib in cmd you can see the attributs.

Here my attributs on C root:

C:\>attrib
A            C:\.rnd
A  SHR       C:\BOOTSECT.BAK
A  SH   I    C:\hiberfil.sys
A  SH        C:\pagefile.sys
A       I    C:\pdiports.cat
A       I    C:\pdiports64.inf
    H        C:\treeinfo.wc

After attrib +h +s c:\treeinfo.wc treeinfo.wc is not shown anymore in windows explorer.

Br,

UEZ

Edited February 25, 2011 by UEZ

[Yashied]

Probably all files with system and hide flag.

With attrib in cmd you can see the attributs.

Br,

UEZ

No. autoexec.bat has only "A" file attribute but it's a protected file.

Edited February 25, 2011 by Yashied

[guinness]

Just polished of my XP box and yeh that file is "Archive" Only so sorry about that. Tried this with no avail too >>

expandcollapse popup

#RequireAdmin

Global $File = FileOpenDialog("Select A File To Find The Details", @ScriptDir, "(*.*)")
If @error Then Exit
ConsoleWrite(_FileDetails($File) & @CRLF)

Func _FileDetails($fd_Path)
    Local $fd_WMIService = ObjGet("winmgmts:{impersonationLevel = impersonate}!\\" & "." & "\root\cimv2")
    Local $fd_ColFiles = $fd_WMIService.ExecQuery("Select * From CIM_Datafile Where Name = '" & StringReplace($fd_Path, "\", "\\") & "'")
    If IsObj($fd_ColFiles) Then
        For $fd_ObjectFile In $fd_ColFiles
            ConsoleWrite("Access Mask: " & $fd_ObjectFile.AccessMask & @CRLF)
            ConsoleWrite("Archive: " & $fd_ObjectFile.Archive & @CRLF)
            ConsoleWrite("Compressed: " & $fd_ObjectFile.Compressed & @CRLF)
            ConsoleWrite("Compression Method: " & $fd_ObjectFile.CompressionMethod & @CRLF)
            ConsoleWrite("Creation ClassName: " & $fd_ObjectFile.CreationClassName & @CRLF)
            ConsoleWrite("Creation Date: " & _WMIDateStringToDate($fd_ObjectFile.CreationDate) & @CRLF)
            ConsoleWrite("CS Creation ClassName: " & $fd_ObjectFile.CSCreationClassName & @CRLF)
            ConsoleWrite("Computer System Name: " & $fd_ObjectFile.CSName & @CRLF)
            ConsoleWrite("Drive: " & $fd_ObjectFile.Drive & @CRLF)
            ConsoleWrite("8.3 File Name: " & $fd_ObjectFile.EightDotThreeFileName & @CRLF)
            ConsoleWrite("Encrypted: " & $fd_ObjectFile.Encrypted & @CRLF)
            ConsoleWrite("Encryption Method: " & $fd_ObjectFile.EncryptionMethod & @CRLF)
            ConsoleWrite("Extension: " & $fd_ObjectFile.Extension & @CRLF)
            ConsoleWrite("File Name: " & $fd_ObjectFile.FileName & @CRLF)
            ConsoleWrite("File Size: " & $fd_ObjectFile.FileSize & @CRLF)
            ConsoleWrite("File Type: " & $fd_ObjectFile.FileType & @CRLF)
            ConsoleWrite("FS Creation ClassName: " & $fd_ObjectFile.FSCreationClassName & @CRLF)
            ConsoleWrite("File System Name: " & $fd_ObjectFile.FSName & @CRLF)
            ConsoleWrite("Hidden: " & $fd_ObjectFile.Hidden & @CRLF)
            ConsoleWrite("Install Date: " & _WMIDateStringToDate($fd_ObjectFile.InstallDate) & @CRLF)
            ConsoleWrite("In Use Count: " & $fd_ObjectFile.InUseCount & @CRLF)
            ConsoleWrite("Last Accessed: " & _WMIDateStringToDate($fd_ObjectFile.LastAccessed) & @CRLF)
            ConsoleWrite("Last Modified: " & _WMIDateStringToDate($fd_ObjectFile.LastModified) & @CRLF)
            ConsoleWrite("Manufacturer: " & $fd_ObjectFile.Manufacturer & @CRLF)
            ConsoleWrite("Name: " & $fd_ObjectFile.Name & @CRLF)
            ConsoleWrite("Path: " & $fd_ObjectFile.Path & @CRLF)
            ConsoleWrite("Readable: " & $fd_ObjectFile.Readable & @CRLF)
            ConsoleWrite("Status: " & $fd_ObjectFile.Status & @CRLF)
            ConsoleWrite("System: " & $fd_ObjectFile.System & @CRLF)
            ConsoleWrite("Version: " & $fd_ObjectFile.Version & @CRLF)
            ConsoleWrite("Writeable: " & $fd_ObjectFile.Writeable & @CRLF)
        Next
        Return 1
    EndIf
    Return SetError(1, 1, 0)
EndFunc   ;==>_CompressEx

Func _WMIDateStringToDate($wd_Date)
    Local $wd_Delimeter = "/"
Return StringRegExpReplace($wd_Date, "(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})\.\d{6}\+\d\d\d", "$3" & $wd_Delimeter & "$2" & $wd_Delimeter & "$1  $4:$5:$6") ; jchd's Efficent Version - $10 Is The Number Of Minutes Difference Between Your Local Time And Greenwich Mean Time.
EndFunc   ;==>_WMIDateStringToDate

[Yashied]

Unfortunately it does not show any differences protected from unprotected files.

[guinness]

Maybe its just one of those things. I tried on C:\hiberfil.sys and it Returned S & H >>

#AutoIt3Wrapper_Au3Check_Parameters=-d -w 1 -w 2 -w 3 -w 4 -w 5 -w 6
ConsoleWrite(_IsSystemFile("C:\hiberfil.sys") & @CRLF)

Func _IsSystemFile($sFilePath)
    Local $sAttribute = FileGetAttrib($sFilePath)
    If StringInStr($sAttribute, "S") And StringInStr($sAttribute, "H") Then Return 1
    Return SetError(1, 0, 0)
EndFunc   ;==>_IsSystemFile

Edit: Read previous posts. So probably looks as though C:\autoexec.bat is an exception to the rule.

Edited February 25, 2011 by guinness

[UEZ]

And probably config.sys is an exception on WinXP system, too.

Br,

UEZ

Edited February 25, 2011 by UEZ