Chapter 4: Managing Files and Directories

Exam Objectives

Working with files and directory structures

Understanding file-naming conventions

Comprehending file attributes

Most people agree that money management is important: When you put your money somewhere, it’s good to have an organized system so you can remember where the money is and retrieve it as needed. Similarly, file management is an important part of any operating system. You need a way to organize the data on your drive so that it is easily retrievable, as well as a way to identify files that are used for certain purposes.

With the changes that the Microsoft-supported file systems have undergone over the years, an A+ Certified Professional needs an understanding of all the file systems because it is highly likely that the computers a professional is called to work on will not all be running the most current OS. In many cases, the computers that require recovery will be running the oldest OS or will have users on the bleeding edge, trying to make use of the newest features of the latest version of Windows.

In this chapter, you get a brief history of file-naming conventions and how they have changed (and, in some cases, stayed the same) over the years. I also tell you what you need to know about file identification and file management and give you an overview of the file attributes associated with the various Microsoft file systems that have come and gone since the days of MS-DOS 1.0.

Identifying File-Naming Conventions

File-naming conventions have undergone several changes over the years. In this section, you get a look at where they have been and where they are now. You also take a look at the differences between filenames and directory entries.

When MS-DOS was the premier OS on the market, it set the standard of the eight-dot-three (8.3)–character filename. This file system was created by using 32 character fields (bytes) for the filenames. If you work out the math, you’re probably wondering where the extra characters are. Well, 8 plus 3 is 11, and that leaves 21 outstanding characters (bytes). Table 4-1 summarizes how each byte is used.

The File Allocation Table (FAT) is an index on your file system that holds a pointer to where each file is stored on your hard drive. On an NTFS (NT file system), this is called the Master File Table (MFT). To move a file on a file system, you only need to change its reference in the table, and not its location in the file system.

Table 4-1 Directory Entry Format

Use	Size
Filename	8 bytes
Extension	3 bytes
Attribute	1 byte
Reserved	10 bytes FAT 32 uses two of these bytes.
Time	2 bytes
Date	2 bytes
First cluster	2 bytes
Size	4 bytes

With every system or component used in a computer, there is a limit; sometimes it is a very large limit, but a limit, nonetheless. That limit is always based on a binary number. Computer systems have RAM limits of 2, 4, 8, or 16GB — never 7.5GB because that is not a binary number. The binary number system is also referred to as Base 2, as compared with our traditional number system, which is Base 10.

Common Base 2 numbers are determined by their digits. For instance, a four-digit Base 2 number has a maximum value of 1111. The following equations figure the value of each digit, from left to right:

1 × 23 = 1 × 8 = 8

1 × 22 = 1 × 4 = 4

1 × 21 = 1 × 2 = 2

1 × 20 = 1 × 1 = 1

Then, when you sum the value of each digit (8 + 4 + 2 + 1), you get 15. Considering that you could have 0000 as a possible value, there are 16 possible values: 0 through 15. When you count the number of possible values for 1-digit to 12-digit Base 2 numbers, the value limits you end up with are 2, 4, 8, 16, 32, 64, 128, 256, 512, 1024, 2048, and 4096.

In cases where the limit is not based on a binary number, some overhead is usually involved. NetBIOS (Network Basic Input/Output System) computer names are 15 characters long, but they fit into the binary system because there is a 16th character used to identify the type of name, and 16 is a common binary limit. As I mention earlier, filenames are 8 plus 3 characters long, which is only 11 characters or bytes in length. However, the name is only part of a directory entry, and the entire entry is 32 bytes long.

When dealing with file attributes, one byte (8 bits) stores all attribute settings. (For more information on file attributes, see the section “Understanding File Attributes,” later in this chapter.) There are not, however, eight attributes.

The 8.3-character naming convention quickly proved to be very limiting. Extensions were often used to allow for longer names and were not directly associated with individual applications. When Windows came onto the market, people began using file extensions properly. Within Windows, the extension was used to identify the application that created a particular document.

Other OSes placed different limits on the length of filenames. For example, Macintosh (before Mac OS X) limited the length of filenames to 31 characters, and Mac OS X limited them to 255 characters. Although 8.3 was very limiting, 255 characters seems excessive, but you likely won’t be limited in your choice of filenames.

Long and short filenames

Windows 9x and Windows 7–based OSes both allow for long filenames on a FAT16 partition (to learn more about FAT16, FAT32, and NTFS file systems, see Book II, Chapter 6). These filenames are limited to 255 characters, but some applications (such as different versions of Windows Explorer) may not be able to display the entire file name. Some older versions of Explorer were only able to display 199 characters, including the period separator for the file extension. Even Windows XP Explorer can only display 220 characters rather than display all the characters of the filename. However, Windows 7 Explorer (255 characters) can display the entire filename. If you want to use names longer than Windows Explorer can display, you have to use a different application.

On a FAT16 or FAT32 partition, you are still limited to the 8.3 naming convention. Windows OSes get around this problem by cheating the file system. When you save a file, it is saved by using one directory entry and a short 8.3-character filename. The short filename is created by using the first six characters of the filename followed by a tilde (~) and an incremental number. After creating four files with the same six starting characters, the formula for creating short names is changed. The first two characters are used, which are then followed by either a randomly or sequentially generated four-digit hexadecimal number (depending on your OS), followed by a tilde (~) and the number 1.

Table 4-2 lists the names of six files and their short filenames that were created in the same directory on a Windows 7 system. To get a listing of the short filenames, you can use dir /x.

Table 4-2 Short Filenames in Windows 7

Long Filename Entry	Short Filename Entry
ShortFileTest1.txt	SHORTF~1.TXT
ShortFileTest2.txt	SHORTF~2.TXT
ShortFileTest3.txt	SHORTF~3.TXT
ShortFileTest4.txt	SHORTF~4.TXT
ShortFileTest5.txt	SHEB78~1.TXT
ShortFileTest6.txt	SH07E0~1.TXT

You have now seen how short filenames are generated, but the question about where the long filenames are stored on FAT16 and FAT32 partitions still exists. The long filenames are stored in additional empty directory entries. The characters for the long filename are stored using 11 characters per additional directory entry. So, a file with a name of

My financial report for 2000.txt

takes one directory entry of the short filename (possibly myfina~1.txt) and one additional entry for each of the 11 characters in the filename, or an additional three entries. That means that this one file would actually occupy four directory entries on your drive. These long filename directory entries have a nonstandard attribute combination of Read-only, Hidden, System, and Volume Label. Although many files on your disk might have a combination of Read-only, Hidden, and System, Volume Label is usually used alone and only on one directory entry that stores the Volume Label for the disk. By using all four attributes, they are a nonstandard combination — and if MS-DOS systems see these entries, they ignore them rather than generating an error.

One of the problems with long filenames occurs when the long filename entries disappear. This can happen if you use older MS-DOS–based disk utilities on your disk. Some of these utilities will tell you that you have a problem with your directory entries and offer to fix them. “Fixing,” unfortunately, means deleting all the “invalid” entries, which means you lose all your long filenames. This is not a good thing.

There may come a time when you attempt to copy files to a destination that does not support long filenames. This used to happen with NetWare 3.x servers that had not enabled long filename support (OS/2 namespace). If this happens, you see a Rename File dialog box, similar to the one in Figure 4-1, for each file that has a long filename.

Creating file associations

Generally speaking, an association is a link between two separate things. File associations link the file extensions of filenames to the programs that can be used to open the files. When dealing with Windows, file associations let the OS know what program should be used to open a specific type of file. This information is stored in the Registry but can be accessed from a number of locations. The Registry is a central location that stores configuration and settings for Windows. Any files not associated with an application will have a generic Windows icon (see Figure 4-2).

Before OS X, Macintosh systems did not use file extensions for associations. Instead, each file was saved with both a data and a resource portion. The resource portion contained the file type and associated application information. Windows-based files are saved only with a data portion. In OS X, files no longer contain a resource portion, and use file extensions to define types of files.

There are a number of different ways in Windows to associate file types with applications:

Double-click unassociated files and assign an application in the dialog boxes that follow.

Press Shift while right-clicking associated files and choosing an Open With option.

Use the Folder Options dialog box.

Edit the Registry.

When working with Windows XP or newer systems, you will usually not need to hold down the Shift key to reach the Open With options. Windows XP, Vista, and 7 also display a nested menu with recently chosen options for that file type, making it easier to switch between applications for that file type.

Microsoft does not recommend editing the Registry with the Registry editor to associate file types with applications since there are other methods available for this task. Using the Registry editor is required to change some Registry information. If you make a mistake with the Registry, you might have to reinstall the operating system. For more information about editing the Registry with regedit.exe and regedt32.exe, consult Book VI, Chapter 4.

For any files not currently associated with an application, you can double-click the file to open it. Windows checks its list of associations; if it cannot locate one, it prompts you for the name of the application that should be used, as shown in Figure 4-3. This dialog box gives you the option to Always Use the Selected Program to Open This Kind of File, which, when selected, places an association with the file extension in the Registry. This is by far one of the easiest ways to create file associations.

This process is easier when using Windows XP and new systems, which also offers to check with Microsoft to see what program can be used with that file extension, in addition to letting you choose it manually, as shown in Figure 4-4.

If you are not sure which program you should use, clear the Always Use the Selected Program to Open This Kind of File check box (from the Open With dialog box; refer to Figure 4-3) prior to choosing the application you want to use with the file. The file will be opened by the application you chose, but the association will not be recorded in the Registry. So, if you chose the wrong application, you can just double-click the file and choose another application.

If you make a mistake or need to change the application that opens a file, you can easily do this through the shortcut menu.

1. Select the file.

If you don’t do this, the Open With option might be missing.

2. Right-click the icon.

In the shortcut menu that appears, you should see an option for Open With. If more than one program can be used with the file type, Open With will be a nested menu listing your program choices, and you will also have the option to select Choose Default Program.

When you select Always Use the Selected Program to Open This Kind of File, you can associate the file extension with the application you select this time through the dialog box.

If you’re looking for a few more options, check out the Folder Options dialog in Windows XP. To get to Folder Options, follow these steps:

1. Open any directory window, such as My Computer.

2. Choose Tools⇒Folder Options.

3. Click the File Types tab to see all the file associations in the Registry.

Windows XP makes this dialog box easy to work with by listing all the file extensions in the top pane, as shown in Figure 4-5. To change the program associated with an application, click the Change button. This opens the Open With dialog box shown in Figure 4-3. From there, you choose a new application for that extension. The dialog layout and use is a little more confusing with earlier versions of Windows, and Microsoft has removed this interface from newer versions of Windows, such as Windows 7.

If you select a file type and click the Advanced button (shown in Figure 4-5), you invoke the Edit File Type dialog box (see Figure 4-6). From this dialog box, you can set additional options for this type of file. These options are located under the Actions section of the dialog box and include

Confirm Open After Download: This option causes a dialog box to appear after using Internet Explorer (IE) to download files with this extension. The dialog will confirm that you want to open the file.

Always Show Extension: Even when Windows Explorer is set up to hide extensions, if this option is selected, the extension will still appear for files of this type.

Browse in Same Window: When loading these files into IE, this lets IE know whether to open a new window to show the file or whether to show the document in the current default window.

When you select one of the listed actions, you can modify how the action is performed on the selected file by clicking the Edit button and then modifying the dialog box shown in Figure 4-7. There, you can specify the full path to the program to open this file type along with any switches (or command options, which are discussed in Book V, Chapter 5) that should be used for that particular program. For example, if the extension has open, print, and printto actions, as shown in Figure 4-7, the Application Used to Perform Action field for the open action might look like this:

C:WINNTsystem32NOTEPAD.EXE %1

In this example, %1 is used by Windows to represent the name of the file that you are working with. When working with the print action, the line might look like this:

C:WINNTsystem32NOTEPAD.EXE /p %1

Finally, for the printto action, your line might look like this:

C:WINNTsystem32NOTEPAD.EXE /pt %1

Most applications will support opening files from a similar command, but fewer will support printing, or printing to a specific device.

Not all applications support printing from the Windows Explorer shell, but for those that do, you can either right-click the file and choose Print or drag them to a printer icon. Dragging the icon to the printer will make use of the document’s printto action.

These same settings or options that we examined here can be used in Windows Vista by making changes directly to the Registry.

Understanding file extensions

In this section, I show you some of the major types of file extensions you can expect to see within your OS. By default, file extensions for registered file types are hidden. Registered files types are files that have extensions which already have applications associated with them. To display file extensions within Windows 7, follow these steps:

1. Open any directory window, such as Computer.

2. Choose Organize⇒Folder and Search Options.

3. Click the View tab (shown in Figure 4-8).

4. Clear the Hide Extensions for Known File Types check box.

5. Click OK.

In the sections that follow, I discuss common file extensions and how they are used on your computer.

Executables

Executable files can perform tasks on the system. Table 4-3 summarizes some of the file extensions common to executable files.

Table 4-3 Executable File Extensions

Extension	Type	Description
.bat	Batch file	A series of commands sequentially typed into a text file
.cmd	OS/2 command file	Usually execute with only a command shell interface
.com	MS-DOS command file	Like the OS/2 command files; usually execute with only a command shell interface
.exe	Command line or graphical program	The most common extension for executable files
.ps1	PowerShell script file	Not executable themselves but require powershell.exe to be executed, they should be considered to be super batch files
.vbs	Visual Basic Script file	Not executable themselves but require either wscript.exe or cscript.exe to be executed; a cross between Visual Basic applications and batch files

Major Office applications

You need to be familiar with the file extensions associated with a few of the most popular office applications on the market. Some of these extensions are listed in Table 4-4.

Table 4-4 Application File Extensions

Extension	Type	Description
.doc .docx	Document files	Usually associated with Microsoft Word; .doc is sometimes used by installations of WordPerfect. Files extensions with an x at the end are used by Microsoft Office 2007.
.dot .dotx	Document ­templates	Document templates for Microsoft Word. normal.dot is the default template for new documents.
.ppt .pptx .pps .ppsx	Microsoft PowerPoint documents	.ppt files open in the PowerPoint interface and are immediately editable. .pps files, when you double-click them, open directly in PowerPoint Slide Show mode and close as soon as the slide show finishes.
.wks .wk4	Lotus 1-2-3 worksheet files	The number at the end denotes that a specific version of Lotus 1-2-3 was used.
.wpd	WordPerfect document	This and .doc are common extensions for documents.
.wpg	WordPerfect graphic	WordPerfect’s proprietary graphic format.
.xls .xlsx	Microsoft Excel document	Spreadsheets associated with Microsoft Excel.

Compression utilities

Over the years, and across operating systems, file compression has always been an issue, leading to the creation of numerous different compression formats. Table 4-5 lists some of the common extensions for compressed files and where they are used. Although some utilities are based in one OS or another, today you can find compression and decompression tools for most formats in most operating systems.

Table 4-5 Compression File Extensions

Extension	Type	Description
.ace	Ace or WinAce	A high-compression format
.arc	Arc or Archive	Traditional Linux and Unix utility
.arj	Archiver Robert Jung (the creator of the format)	Traditional archive utility for MS-DOS
.bhx .hqx	BinHex files	Macintosh encoding format
.cab	Cabinet file	Microsoft format for distributing software
.rar	Roshal Archive (created by Eugene Roshal)	High-compression format used on most operating systems
.sit	StuffIt	Most popular Macintosh compression format
.tar	Tape archive files	Traditional, highly used archive format for Linux and Unix that can back up directory structures into a single file rather than compress them; often used in conjunction with gzip
.tgz	tar-gzip	Traditional, highly used compression format for Linux and Unix; actually a gzip-ed TAR file
.uu .uue	Uuencode	One of the most popular encoding algorithms for Linux and Unix
.zip	PKZIP	The grandfather of PC compression formats; still the most used format for the MS-DOS and Windows worlds

System files

Several types of files drive your computer’s operating system. Some of the extensions you should expect to see on system files are listed in Table 4-6.

Table 4-6 System File Extensions

Extension	Type	Description
.ani	Animated cursor files	Contains animated mouse pointers
.bak	Backup files	Used as a default extension by a number of applications
.bin	Binary drivers	Used for a few system drivers, such as drvspace.bin
.cpl	Control Panel files	Contains interface to adjust Windows ­settings
.cur	Cursor files	Holds the graphical information to display your mouse cursor
.dat	Data files	Used with the Registry files, such as ntuser.dat
.dll	Dynamic Link Library	Contains common and reusable code that can be called by any application to reduce the amount of code that has to be placed within specific applications
.drv	MS-DOS or real-mode driver files	Contains MS-DOS–formatted binary drivers
.ini	Initialization files	Text files that contain settings for applications; phased out in favor of the Registry
.msc	Microsoft Console settings files	Seen often with Windows 2000 or above and a bit with Windows NT 4.0
.msg	Error message files	Contains messages to be displayed in the event of an error; were used with the MS-DOS network client, and were only required if you wanted to see a text description of error codes
.msi	Microsoft Installer files	A file format used to distribute software to computers running the Windows Installer service
.scr	Windows screensaver files	Holds binary code to display Windows-based screen saver
.sys	System driver files	Used with MS-DOS and Windows for backward compatibility
.ttf	True Type font definition files	Contains formula description used to display scalable fonts
.vxd	Virtual device ­drivers	Holds binary code for Windows-based device drivers

Graphic files

Graphics have been an important part of computers since computers were invented and were able to print. Early graphics were generated using the standard ASCII character set and used to create simple graphs or rudimentary graphics. A number of different formats have become popular; with the popularity of the Internet, the number of major graphic formats has greatly increased. For a listing of graphics formats, see Table 4-7.

Table 4-7 Graphic File Extensions

Extension	Type	Description
.bmp	Bitmap	Used by MS Paint
.eps	(Adobe) Encapsulated PostScript	Used by several major graphics applications
.gif	Graphic Interchange Format	Owned by AOL (originally owned by CompuServe); designed to minimize download times
.jpg .jpeg	Joint Photographic Experts Group	A compression format that discards data (“lossy”) thought to be invisible to the human eye
.pcd	Kodak Photo CD	A special format of image to be displayed on devices that support Kodak Photo CD
.pcx	PC Paintbrush	An early Windows graphic format
.pdf	(Adobe) Portable Document Format	Readable by Adobe Acrobat and Adobe Reader
.png	Portable Network Graphics	A free photo standard planned as a replacement for .gif and .jpeg because it supports all the benefits of both formats and uses a Zip type algorithm for compression
.tif .tiff	(Aldus) Tagged Image File Format	Used as a common interchange format between most graphics applications; very popular with photographic manipulators; supports LZW (Lempel-Ziv-Welch) compression format to reduce file sizes and is not lossy

Other file extensions

Table 4-8 has some other extensions that are worth noting.

Table 4-8 Miscellaneous File Extensions

Extension	Type	Description
.asp .aspx	Active Server Page Active Server page Extended	Server-side scripted HTML files
.cda	CD Audio	Stores audio data on audio CDs
.css	Cascading Style Sheet	Stores HTML-style data
.htm, .html	HyperText Markup Language	Stores data displayed on Web sites
.tmp	Temporary file	A short-term storage file
.txt	Text file	ASCII text files that are readable on every operating system
.wav	Windows Audio files	Audio files designed specifically for use with Windows

Web servers use HTTP (HyperText Transfer Protocol) to send the information to your Web browser. HTML is popular for displaying information locally as well. Many vendors send Help files in this format so that they can be used on both their Web sites and as offline files.

You should be familiar with all these extensions and the categories to which they belong. Pay additional attention to executable, application, and system files.

Lab 4-1 provides some practice working with file associations. You will require a computer with Windows 2000 or XP. The labs can be downloaded from the website www.dummies.com/go/aplusaio.

Understanding File Attributes

Since the first versions of MS-DOS and the FAT file system (see Book II, Chapter 6), files have had some basic attributes. The following sections deal with only the attributes that a computer user will manage: namely, Read-only, Hidden, System, and Archive. The discussion focuses on the basic attributes, the extended attributes offered by Windows NTFS, and how to change the file attributes.

How attributes are stored

Attributes are stored as a single, 8-bit binary number. Because each bit can hold either a 0 or a 1, this yields 256 possible combinations of attributes — from eight 0s (no attributes applied; equal to 0 in decimal notation) to eight 1s (all attributes applied; equal to 255 in decimal notation).

Because each attribute holds a specific bit position, if several attributes are applied to a file, you can add the values (either binary or decimal) together to get a unique number that is 255 (11111111 in binary) or less for each unique combination of attributes. For example, if the file had the attributes of Read-only (1), System (4), and Archive (32), the value of the attribute byte would be 1 + 4 + 32, or 37. Only 37 (00100101 in binary) could represent a file with these attributes. The full list of attributes is listed in Table 4-9.

For the exam, you will be asked only about the Read-only, Hidden, System, and Archive attributes. Still, you should be aware of the Volume Label and Subdirectory attributes for real-world applications. You do not need to know the bit values of any of the attributes; just know what the four basic attributes are used for.

The basic attributes

All files on your computer, regardless of your Microsoft OS or file system, have these four basic attributes:

Read-only

Hidden

System

Archive

Descriptions of the four common attributes are listed in Table 4-10.

Table 4-10 Basic File Attributes

Attribute	Description
Read-only	Cannot be deleted from the command line and cannot be written to or saved over.
Hidden	Invisible to users unless those users have changed their viewing options to display hidden files. Hidden files cannot have their attributes changed by the attrib.exe command.
System	Flagged as being required by the operating system. They cannot have their attributes changed by the attrib.exe command.
Archive	Ready for archiving or backing up. This attribute is used by some backup programs so that they can perform incremental ­backups. Currently, the xcopy and robocopy commands support the /a and /m switches, indicating that only files that have the Archive attribute set should be copied, while /m also clears the Archive attribute. When the file is modified, the Archive attribute will automatically be reset on it.

Any time files are modified, the Archive attribute is automatically set. Thus, after Windows is installed, all files have the Archive attribute enabled. Windows also sets Read-only, Hidden, and System attributes on many required system files to prevent accidental modification or deletion by the user. Other than these files, though, the only attribute automatically set is Archive. You can see how to manually set these attributes later in the upcoming section, “Setting basic attributes.”

Windows NTFS extended attributes

Windows XP, Vista, and 7 have three other file attributes that are used on NTFS partitions. These three attributes are often referred to as extended attributes:

Compress: Used to enable on-the-fly file level compression of data

Encrypt: Used to enables on-the-fly file level encryption of data

Index: Used to allow files to be indexed by the OS Indexing Service

The sections that follow take a closer look at each of these attributes.

Compress

The Compress attribute allows and restricts file compression. To compress a file or folder, follow these steps:

1. Right-click the file or folder and choose Properties.

2. In the Properties dialog box that appears, click the Advanced button.

3. From the Advanced Attributes dialog box, you can compress the file or folder by selecting the Compress Contents to Save Disk Space check box, as shown in Figure 4-9.

If you are using the default Windows Explorer settings, files and folders that have the Compress attribute set will be displayed with blue text.

To compress a file, the file needs to be read into memory, where compression takes place, and then rewritten to the disk in its compressed form. When you change the Compress file attribute, the OS saves the change to attribute prior to actually going to steps of compressing the file. This is done in two steps because the attributes are stored in the MFT and not in the actual file itself. After the attribute change is recorded, file compression for that file is performed. Because of the small chance that something could go wrong during the compression phase, some of the files on your hard drive might have the Compress attribute set yet not actually be compressed. One situation that might cause this inconsistent Compress attribute is a power interruption during the compression process, resulting in the attribute change being made but a compressed version of the file not saved. To ensure that this has not happened, you could use the compact.exe command line utility.

You can use compact.exe to compress or decompress files from the command line. It supports switches that allow it to process subdirectories as well. If you suspect inconsistent compression states for your files, you can use the /F (force switch), which goes through the process of compressing all files, even if they already have the Compress attribute. This does not double-compress files, but rather ensures that all files that are supposed to be compressed actually are compressed. See Table 4-11 for a complete list of the switches that compact.exe makes use of. If you run compact.exe without any switches, it will display compression information for the files in your current directory.

Table 4-11 compact.exe Command Switches

Switch	Description
/A	Displays files with the hidden or system attributes. These files are omitted by default.
/C	Compresses the specified files. Directories will be marked so that files added afterward will be compressed.
/F	Forces the compress operation on all specified files, even those which are already compressed. Already-compressed files are skipped by default.
/I	Continues performing the specified operation even after errors have occurred. By default, compact.exe stops when an error is encountered.
/Q	Reports only the most essential information.
/S	Performs the specified operation on files in the given directory and all subdirectories. Default directory is the current directory.
/U	Uncompresses the specified files. Directories will be marked so that files added afterward will not be compressed.

If you move a compressed file within a partition, the file will retain its Compression attribute. However, if you copy a compressed file to a folder, it inherits the Compression attribute that is set for the destination folder.

Encrypt

An encrypted file is protected only against being read. This means that the file can be moved to another location on the same partition or renamed; these actions require modifying the directory table and do not constitute reading the file. The file may also be deleted if the appropriate NTFS permissions have not been applied to it.

To encrypt a file or folder, follow these steps:

1. Right-click the file or folder and choose Properties.

2. In the Properties dialog box that appears, click the Advanced button.

3. From the Advanced Attributes dialog box, you can encrypt the file or folder by selecting the Encrypt Contents to Secure Data check box.

If you are using the default Windows Explorer settings, files and folders that have the Encrypt attribute set will be displayed with green text.

If the user who encrypted the file then moves or copies a file between NTFS partitions (even between computers), the file will remain encrypted. This is different from Compression or NTFS permissions. If the file is copied to a non-NTFS partition, the file is automatically decrypted. If you cannot decrypt the file, you will receive an Access Denied message when you attempt to move the files to a location which is on a different partition.

Public Key Infrastructure (PKI) is a system that allows for authentication users and encryption of data. PKI works with key pairs that are used to encrypt or decrypt data. The pair of keys is defined as private (known only to the user) or public (known to all other users of the infrastructure). Public keys are usually stored in certificates. When data is encrypted by using a public key, it can be decrypted only by using the related private key from the key pair. Encrypting File System (EFS) makes use of PKI. If you do not have an infrastructure, the local workstation will auto-generate keys on the local computer to support EFS. If you are using EFS within an organization, you should make use of an enterprise-wide PKI, which can be implemented by using the Microsoft Windows Active Directory Certificate Services.

Windows does not allow you to both encrypt and compress a file. This is because compression requires that the file be rewritten, and encryption does not allow the file to be rewritten. The reason why encryption does not allow the file to be rewritten is because the file header contains the file’s encryption keys. These keys are protected by the public key of the user who encrypted the file as well as the public key of the EFS Recovery Agents. The EFS Recovery Agent is specified in the local public key policies of the computer or in Active Directory. By default on a workstation or an Active Directory domain, the EFS Recovery Agent will be set to the Administrator account. When a file is encrypted, the only people who can read the file are the user who enabled encryption, the EFS Recovery Agent, and any other users who specifically had their public keys used to encrypt the file’s encryption keys.

To allow other people to access your encrypted files, follow these steps for a file that has been encrypted:

1. Right-click the file or folder and choose Properties.

2. In the Properties dialog box, click the Advanced button.

3. In the Advanced Attributes dialog box, click the Details button.

The Encryption Details for the file dialog box opens, listing all users who can transparently access the file.

4. Click the Add button.

The Select User dialog box opens.

5. If the user you want to grant access to is not on the list, your action depends on whether you are in a domain:

• If you are in a domain, click the Find User button to access the standard OS Select User dialog box.

• If you are not in a domain, select the user you want to add and then click OK, as shown in Figure 4-10.

6. If you are not in a domain or if the user you want to grant access to is not in the domain, you will need to get him to send you a copy of his certificate, which you will import into the system by double-­clicking the certificate file in Windows Explorer.

7. Click OK on each of the other dialogs that opened.

If you do not have an enterprise PKI, you cannot access certificates for other users, so you will not be able to easily grant other users access to encrypted files.

Similar to compress.exe for compressing files, you can use the command line utility cipher.exe to encrypt files from the command line or in batch files.

In the same way that you could use compress.exe for compressed files, you can use cipher.exe for encrypted files. Table 4-12 reviews the switches that can be used with the cipher.exe command.

Table 4-12 cipher.exe Command Switches

Switch	Description
/A	Operates on files as well as directories. The encrypted file could become decrypted when it is modified if the parent directory is not encrypted. It is recommended that you encrypt the file and the parent directory.
/D	Decrypts the specified directories. Directories will be marked so that files added afterward will not be encrypted.
/E	Encrypts the specified directories. Directories will be marked so that files added afterward will be encrypted.
/F	Forces the encryption operation on all specified objects, even those which are already encrypted. Already-encrypted objects are skipped by default.
/H	Displays files with the hidden or system attributes. These files are omitted by default.
/I	Continues performing the specified operation even after errors have occurred. By default, ciphere.exe stops when an error is encountered.
/K	Creates new file encryption key for the user running ciphere.exe. If this option is chosen, all the other options will be ignored.
/N	This option works only with /U. This will prevent keys being updated. This is used to find all the encrypted files on the local drives.
/Q	Reports only the most essential information.
/R	Generates an EFS recovery agent key and certificate, then writes them to a PFX file (containing certificate and private key) and a CER file (containing only the certificate). An administrator may add the contents of the CER to the EFS recovery policy to create the recovery agent for users, and import the PFX to recover individual files.
/S	Performs the specified operation on directories in the given directory and all subdirectories.
/U	Tries to touch all the encrypted files on local drives. This will update user’s file encryption key or recovery agent’s key to the current ones if they are changed. This option does not work with other options except /N.
/W	Removes data from available unused disk space on the entire volume. If this option is chosen, all other options are ignored. The directory specified can be anywhere in a local volume. If it is a mount point or points to a directory in another volume, the data on that volume will be removed.
/X	Backup EFS certificate and keys into file filename. If efsfile is provided, the current user’s certificate(s) used to encrypt the file will be backed up. Otherwise, the user’s current EFS certificate and keys will be backed up.

Index

Indexing the file system will greatly improve the time it takes to search your hard drive. On the downside, though, indexing demands space on your drive. Indexing not only records the filenames and locations, but will also record words found in your files. The indexing service has a set of “noise words” that it ignores, such as it, that, is, not, and the. As files are indexed, the results are stored in a catalog; when searching for files, you can specify the catalog you want to use. By default, a catalog — a system — is configured to index your local files on your hard drives. Find this default catalog in the System Volume Information directory of your boot drive or C: drive.

To enable basic indexing of your drive, follow these steps:

1. Right-click your drive in Computer (or My Computer for XP users) and choose Properties.

2. Select the Allow Files on This Drive to Have Contents Indexed in Addition to File Properties (Index This Drive for Faster Searching for XP users) check box (see Figure 4-11).

This enables indexing, provided that the Indexing Service is running.

You can verify that the Indexing Service is running on Windows XP by using the Services Administrative Tool (Start⇒Control Panel⇒Administrative Tools⇒Services) and verifying that the Indexing Service is started. For Windows Vista users, you will find the Services Administrative Tool in Start⇒Control Panel⇒System and Maintenance⇒Administrative Tools⇒Services. Windows 7 and Vista will always have the Indexing Service running, and Microsoft has removed the Index service from the Services interface of Windows 7.

Just because a folder is allowed to be indexed, that does not mean that it will be indexed. Windows 7 includes a default set of locations that it will index for you, which you are able to modify or add to. Although you may search the Control Panel for Indexing Options, the most likely way you will get to this dialog is when you are attempting to search nonindexed locations. To see this in action, follow these steps:

1. Open a folder in Windows Explorer that is not indexed.

This is just about all folders on the root of the C: drive, or folders on other drives on your computer.

2. Type a search word into the Search field in the upper-right corner of the window and press Enter.

A gold band will be displayed in the window stating that Searches Might Be Slow in Non-indexed Locations: <Folder Location>. Choose Click to Add to Index, as shown in the background of Figure 4-12.

3. Click in the gold band to access options, which include Add to Index and Modify Index Locations.

4. To add the currently nonindexed location to your index:

a. Choose Add to Index.

b. Confirm your choice by clicking the Add to Index button in the Add to Index dialog.

5. For each location you want to modify in your index:

a. Choose Modify Index Locations to open the Indexing Options dialog, shown in the foreground of Figure 4-12.

b. Click the Modify button. This will open the Indexed Location dialog.

c. Place check marks in front of any folders you want to have indexed.

Setting basic attributes

Like so many other areas of an operating system, where there are many different ways to achieve your goal, there are many different ways to change the attributes of files. The first method — using the command line — is the only way common to all Microsoft OSes, but keep reading to see how to set attributes via the Windows GUI.

Command line

To change file attributes from the command line, start at the Command Prompt window (choose Start⇒All Programs⇒Accessories⇒Command Prompt). In the Command Prompt window, you can set attributes by using the attrib.exe command. The basic syntax for the command is this:

attrib <attribute to set (H, S, R, A)> <files to modify>

Setting attributes also includes a plus sign (+; enabled) or minus sign (–; disabled), followed by a one-letter code for each attribute. For example, to set the read-only attribute and remove the archive attribute from the C:oot.ini file, use the following:

attrib.exe +R –A C:oot.ini

The one-letter codes are as follows:

A: Archive

H: Hidden

R: Read-only

S: System

Windows 7 and Vista include an I attribute for Indexed, or more correctly, Not Indexed. Setting this attribute is the same as deselecting the Allow This File to Have Contents Indexed in Addition to File Properties check box in the Advanced Attributes dialog of the file, which was discussed earlier in this chapter in the “Index” section. Because indexing has already been covered, this section will deal with the four remaining attributes.

If you use the attrib command without any options, it displays a list of current attributes of all files in the current directory. Here is a sample of what that would look like:

C:>attrib.exe

A       C:7flen.crt

A SHR   C:arcldr.exe

A SHR   C:arcsetup.exe

A       C:AUTOEXEC.BAT

A SH    C:oot.ini

A       C:CONFIG.SYS

A SHR   C:IO.SYS

A SHR   C:MSDOS.SYS

A SHR   C:NTBOOTDD.SYS

A SHR   C:NTDETECT.COM

A SHR   C: tldr

A       C:uninst.log

If you use the attrib.exe command with options but without specifying a filename, you set the attribute(s) for all the files in the current directory. Here is an example of the command and the attributes that would be set:

C:>attrib.exe -A -S -H -R

      C:7flen.crt

      C:arcldr.exe

      C:arcsetup.exe

      C:AUTOEXEC.BAT

      C:oot.ini

      C:CONFIG.SYS

      C:IO.SYS

      C:MSDOS.SYS

      C:NTBOOTDD.SYS

      C:NTDETECT.COM

      C: tldr

      C:uninst.log

You can specify a file after the attrib command to see the current attributes of that file, or you can include the one-letter codes to set the attribute(s), like this:

C:>attrib.exe C:oot.ini

A     C:BOOT.INI

C:>attrib.exe +h +r C:oot.ini

C:>attrib.exe C:oot.ini

A HR   C:BOOT.INI

Another option you can include with the attrib.exe command is /s, which instructs attrib.exe to process the files in all subdirectories. This does not change the attribute on the subdirectories, just the files in the subdirectories. Using /d will change the attributes of the directories as well.

There are some restrictions on changing attributes with the attrib.exe command. Hidden and System files will not have their attributes changed unless the current Hidden or System attribute is also specified in a single command. Examine the following command sequence, which shows an example of dealing with Hidden or System files:

C:>attrib.exe C:oot.ini

A SH   C:oot.ini

C:>attrib.exe -S -H -A -R C:oot.ini

C:>attrib.exe C:oot.ini

      C:oot.ini

C:>attrib.exe +S C:oot.ini

C:>attrib.exe +R C:oot.ini

Not resetting system file - C:oot.ini

C:>attrib.exe C:oot.ini

  S    C:oot.ini

C:>attrib.exe +R +S C:oot.ini

C:>attrib.exe C:oot.ini

  S R   C:oot.ini

C:>attrib.exe +H C:oot.ini

Not resetting system file - C:oot.ini

C:>attrib.exe +H +S C:oot.ini

C:>attrib.exe C:oot.ini

  SHR   C:oot.ini

C:>attrib.exe +S +H -R C:oot.ini

C:>attrib.exe C:oot.ini

      C:oot.ini

Windows GUI

In addition to the command line interface for changing attributes, Windows offers a GUI interface. When you right-click a file, you only see the options for Read-only, Hidden, and Archive when working with FAT partitions. If you are working with NTFS partitions, the Archive check box is replaced with an Advanced button, as shown in Figure 4-13.

Clicking the Advanced button allows you to set the Archive attribute as well as the Windows NTFS advanced attributes of Index, Compress, and Encrypt. See Figure 4-14.

Lab 4-2 provides some practice working with attributes via the command line. For this exercise, you need a computer running Windows. The labs can be downloaded from the website www.dummies.com/go/aplusaio.

Getting an A+

This chapter discusses file and directory management from the point of view of file naming and file attributes. The following major points are covered:

Windows is not limited to the 8.3 naming convention.

Windows supports simulated 8.3 naming for backward compatibility.

The four basic file attributes are Read-only, Hidden, System, and Archive.

Windows XP, Vista, and 7 support additional file attributes for compression, encryption, and indexing. These attributes are available only on the Windows NT File System (NTFS).

The Archive attribute is still used by many backup programs to locate files that have changed since the last backup.

Prep Test

1 What is the maximum character length of a filename under Windows XP?

A 64

B 128

C 254

D 255

E 256

2 You get a call from Billy. You find out that he has a problem with several of the files on his hard drive. He claims that Windows Vista has renamed many of his files and directories. After questioning him, you find out that he just defragmented his hard drive with an MS-DOS 6.0 boot disk and the MS-DOS version of defrag.exe. What is likely the cause of the problem, and is there a solution to correct it?

A The MS-DOS version of defrag.exe was unaware of the long filename directory entries and overwrote the directory entries. There is no easy fix for this problem.

B The long filename entries have just become unassociated from the files. Run assoc c: /repair to reestablish the associations.

C The filename entries are fine; they were automatically backed up, and Billy just needs to run lfnbk from the root of each drive.

D Everything is fine; Billy just needs to reboot.

3 Which of the following can be used to associate file extensions with an application? Choose all that apply.

A attrib.exe

B assoc.exe

C Shift+right-click and choose Open With.

D Choose Tools⇒Folder Options⇒Associate tab.

4 Which of the following are extensions of executable files? Choose all that apply.

A .ini

B .prg

C .exe

D .cmd

5 Which of the following file extensions are associated with compression programs? Choose all that apply.

A .com

B .zip

C .cmp

D .cab

6 Which of the following attributes are associated with files on your hard drive? Choose all that apply.

A Restrict-Modify

B Archive

C Visible

D Hidden

7 When you copy an NTFS compressed file to a FAT32 partition, what happens to the file?

A The copy action is denied.

B The file is copied but remains compressed, so it is unreadable.

C The file is copied but becomes uncompressed.

D The file can be copied only if the FAT32 partition has been compressed with DriveSpace compression.

8 You are moving several of Bob’s files from a directory to another directory on the same partition. What message should you receive when you encounter an encrypted file?

A You should not receive a message; the file will just be moved.

B You should get an Access Denied message.

C You should get a message stating that you could not read the file, and that it may be corrupted.

D You should get a message stating that the file cannot be moved because it is encrypted.

9 You are moving several of Bob’s files from a directory on an NTFS partition to a directory on a FAT32 partition. What message should you receive when you encounter an encrypted file?

A You should not receive a message; the file will just be moved.

B You should get an Access Denied message.

C You should get a message stating that you could not read the file, and that it may be corrupted.

D You should get a message stating that the file cannot be moved because it is encrypted.

Answers

1 D. The maximum length of a filename is 255 characters. See “Long and short filenames.”

2 A. You should only use Windows 2000 or newer utilities to maintain your disks. Review “Long and short filenames.”

3 C. attrib.exe is used to change file attributes and not file associations. assoc.exe does not exist, and the correct path on a Windows XP computer is Tools⇒Folder Options⇒File Types. Peruse “Creating file associations.”

4 C, D. .exe files are executable program files and .cmd files are text files similar to batch files but are treated as executable. Take a look at “Understanding file extensions.”

5 B, D. PKZIP files use the .zip extension, and .cab files are a proprietary, Microsoft compression format. Peek at “Understanding file extensions.”

6 B, D. The four basic attributes are Read-only, Hidden, System, and Archive. The advanced NTFS attributes are Compress, Encrypt, and Index. Look over “Understanding File Attributes.”

7 C. Compressed files copied from NTFS volumes to any other type of disk will become uncompressed. If they are copied to other NTFS volumes, they will inherit the compression attribute from the destination folder. Study “Windows NTFS extended attributes.”

8 A. As long as the move is within one partition, the files will just be moved. If the directories are on different drives, you would receive an Access Denied message. Refer to “Windows NTFS extended attributes.”

9 B. Because the files are being moved to a different drive and you are not the person who encrypted the files, or an EFS recovery agent, you will be denied access. If you had owned the files, the files would have been decrypted as they were copied. Examine “Windows NTFS extended attributes.”