nt-part2_90
Analysis of the Security of Windows NT
1 March 1999
90
D.3 Maintenance Programs
D.3.1 NTFSDOS
NTFSDOS is a program that makes it possible to read NTFS volumes from MS-DOS
or Windows 95. Today, there exist programs that are also able to modify files on NTFS
volumes, see descriptions of NTFS Tools, ERC Commander and NTRecover below,
from MS-DOS. The implications of this are that any system with a floppy drive that
can boot from another OS is insecure.
D.3.2 NTFS Tools
NTFS Tools is a package with two utilities, NTFSCopy and NTFSRen. It is a add-on
for NTFSDOS that provides limited modify capabilities for NTFS volumes from MS-
DOS. The package is intended to be used to repair system errors in NT. Each utility
supports a single operation, i.e. file copy and file rename. However, both have certain
limitations. The copy command is used to overwrite an existing file, and will only suc-
cess if the source file and the destination file are of the same size. The rename com-
mand will not let a user specify a new file name, it is chosen by the program.
Furthermore, the chosen name must not already exist.
D.3.3 ERD Commander
ERD, short for Emergency Repair Disk, Commander let an NT system be booted from
a floppy. The utility is shipped with a setup program, which will allow the user to cre-
ate a set of NT boot floppies. After the boot floppies are created, a stripped down ver-
sion of NT can be started from the floppy. Indeed, NT does not even need to be present
on the computer. All NT supported file systems will be visible. The complete set of
commands ERD commander provides is in Table 9.
TABLE 9. Commands in ERD Commander as described on the Web site.
Command
Description
ACCESS
Gives Everyone full access to a files or directories.
CD
Displays the name of or changes the current directory.
CLS
Clears the screen.
COPY
Copies one or more files to another location.
DEL
Deletes one or more files.
DIR
Displays a list of files and subdirectories in a directory.
EXIT
Quits ERD Commander and reboots the system.
HELP
Provides Help information for ERD Commander commands.
MAP
Displays drive letter to partition mapping.
MKDIR
Creates a directory.
MORE
Displays the contents of a file.
MOVE
Moves one or more files from one directory to another directory.
RENAME
Renames a file or files.
RMDIR
Removes a directory.