Once Upon a Thursday..

Mr. Siva Rao lives somewhere in Jayanagar with his one wife and two sons, the eldest of who is yet to appear for his PUC examinations after his two failed attempts. Known to people as Mr. Siva Rao, although his birth certificate identifies him as Vijayawada Sitaramanjaneyula Rajasekhara Yarlagadda Venkata Samba Siva Rao, he is one man who could over react for even the tiniest murmur of thunder in the sky. Known for his shrill audible voice and chalk white lungi that he keeps folding up his waist, Mr. Siva Rao threatens kids, dogs and bikers alike around his locality. He travels to office everyday on his new CBZ, thank heavens he wears pants then.

It was a beautiful Thursday morning. I was still lazing in bed when I heard Mr. Siva Rao yelling on top of his voice. I could also hear the soft spoken voice of Mrs. Rao coming out through their kitchen window. “How am I supposed to cook? I have been telling you to get the cylinder before this one gets over? Don’t tell me I did not warn you?” I could vaguely imagine Mrs. Rao, a short beautiful woman in her mid 40s, pointing her stubby fingers at the now worthless piece of metal. Mr. Rao then proceeded to say something in his native tongue, which fortunately I didn’t understand, but he sounded angry. Then abruptly there was silence. I wondered whether a peace treaty had been signed or Mrs. Rao was now no more. I sat upright in my bed, stretching myself. I looked out of my window again to see signs of any movement. Their kitchen window was locked; I assumed there wouldn’t be any more verbal ranting so I slipped out of bed to begin my day.

I went through the morning routine methodically to prevent any wastage of water or electricity which the caretaker of our PG house constantly reminds us of. I ironed my clothes, wore my shoes and stepped out wearing a smile that could give Mona Lisa a run for money.

I first thought it was funny to see 4 men on a bike next to the signal where I usually wait for the bus to arrive, but then I realized, it was the same scene everywhere! Cars were carrying 7-8 people, bikes were loaded with 3-4 people and buses were overflowing! I rubbed my eyes to swallow what I could see. There was less traffic on the road though, even at this peak hour. I was nonchalant and assumed it to be just casual traffic police maneuvers. I skipped 6 buses due to the sudden increase in commuters. The doors would not close, I couldn’t see the driver and the windows were all covered with bums of different sizes. Weird I thought. Looked like as if half of China had invaded India, although, I dint see any Mongoloids amongst the crowd. I was running out of time and knew I would get late for my Annual Performance Review meeting with my Manager. I prayed in silent tears.

Somebody on a bike with a pillion rider stopped in front of me. I was happy to see that there were only two people on the bike. The rider pulled off his helmet and then I recognized Mr. Siva Rao. The pillion rider identified himself as Mr. Shetty, Engineer at another Software company down on Outer Ring Road. Mr. Siva Rao spoke hesitantly with his usual deep accented Tamil accent, “So you waiting for bus? No bus. No bus. Mr. Shetty here waiting for bus since 8.00 AM in the morning. All crowded. You come, I drop you to office. On way to Marathalli right. Sit sit.” I couldn’t refuse but I couldn’t stop myself from asking, “Eh.. Mr. Rao… won’t the police fine us for riding three on a bike?” Mr. Siva Rao smiled showing his misshapen canines. “Police no say anything. People taking lifts and using buses to reach office. Less traffic faster to reach office less petrol you see.” I could see the end of the tunnel from where all insanity of the public was coming from. I shrugged, squeezed between Mr. Siva Rao and Mr. Shetty and closed my eyes for the rest of the journey.

Mr. Siva Rao dropped me at the closest signal to my office and scampered on with Mr. Shetty although in the distance I could see him wait and pick up another hapless stranded soul on the Ring Road. I brushed off the creases on my shirt and crossed the road. Several people were on foot today. I saw my colleague Ritesh** entering the gates as I walked up to him. “No bike today huh?” He responded with a cold shrug and stared stone faced to the building entrance. “A walk a day keeps the doctor away!” I shook my head; I had heard wittier words than those from him.

My day at the office was normal, with just a few bumps here and there. Lunch was something I was looking forward to. Precisely at 2:00, I locked my workstation and proceeded down towards the cafeteria. Several employees were standing at the entrance talking in hushed tones. I saw several of my friends in the lot too. I walked up to them. “Wassup people? Why is everybody out here?” Raees** whisked me out of the crowd and pointed steadfast at a small notice that had been put up at the counter. I carefully read and re-read the posting. I now knew why people appeared scared and why Raees and the others were tensed as if their exam results were to be declared that afternoon.

I walked down towards the lonely mess that is visited by a handful of people down the road outside the campus wondering aloud; “70 bucks for that food?? That’s more then a 50 percent hike in prices. God what else?”

I had never been to a mess before, but what I had heard from the others, the food was good and cheap and this place was hardly visited by anybody. I reached the place following crudely drawn directions given to me by another of my colleague, Guru**. I couldn’t recognize the place though because it had been described by people as a deserted waste of space. There were atleast 30 people in there and several standing in a queue outside!! I saw a familiar face in the queue, I didn’t know his name but he was from the same floor that I worked on. I waved to him and casually walked up to where he was standing. Assuming it was unbeknownst to the others, I slowly moved my feet, inch by inch in to the queue. As soon as my feet were inside I proceeded to shift the rest of my body in to the line, discussing mundane topics like the elections, Harry Potter and Carmen Electra with my new found friend to throw him and the others off the track. But alas I forgot there were several seasoned players in this game already in the queue. I soon found myself whisked at the end of the line by several pairs of black strong hands that looked and smelt of tar.

I returned to my lab an hour and half later having had the tastiest food that I had eaten in months. I then proceeded to complete my work. Precisely at 6:00, I fired off the mails that I had kept pending for the past few days. Forwarded some nasty office jokes to my friends, locked the workstation and walked down the stairs to begin my journey back to my room.

My afternoon had passed off peacefully and the morning just seemed so far away. As I walked out of the gate, reality slapped me so hard, my eyes watered. There was less traffic no doubt. But the scenario had not improved a tad. There were people on bikes, cars were loaded. I saw several engineers (by the looks of them and the laptop bags they carried) on the top of three trucks, smiling and waving out to people as if they were campaigning for elections!! I vaguely remembered Swades. I flicked out my new Sony Ericcson Z555i with Gesture Control 2 MP camera phone and randomly clicked some pictures. Down the 8th picture, my phone started ringing. Some unknown number, I hoped it wasn’t some bank wanting to give me a personal loan or credit card or something. The excited voice on the other end was familiar. “Look behind, look behind, behind the red truck, between the bus and the truck… look look…” I turned around to see Mr. Siva Rao flailing his hands as if he had just seen Sachin Tendulkar. I walked up to him and smiled. He looked small without his helmet on. Unbelievably he was alone. I did not question him but clambered on to the bike to get home.

I slept peacefully that night dreaming about me discovering an oil well in the background of my PG house, becoming rich overnight and marrying Katrina Kaif. The first thing I did with the money in my dreams was to buy a bicycle. Thanking God they didn’t run on petrol.

** Names changed to protect privacy.

NTFS Alternate Data Streams

The NTFS file system was a remarkable creation for the world of Windows. Windows NT systems have proven their local security largely on the basis of the NTFS file system. It included several new features: quotas, sparse file support, reparse points, distributed link tracking and the Encrypting File System (EFS). What I am going to describe here is not the file system itself, but a little known property of NTFS called ADS. ADS does not stand for Active Directory Services or Asynchronous Digital Systems or Another Dead Soul or anything that whacky. ADS or Alternate Data Stream is any data attached to another file but not within the file itself. Windows implements many of its little known functions like additional file information and tagging files as encrypted using ADS.

One of the most common uses of ADS has to store additional file information like the Authors name, Word count, Pages and other document data of a word file. You can view and edit this information by right clicking a word document >> properties and clicking on the summary tab. In fact any file will have a summary tab on an NTFS drive so that you can indirectly edit the ADS of that particular file. A file without any custom information added, contains a single data stream called $DATA which is the data inside the file itself and is not an alternate data stream. Any other streams attached to it will have the format filename.extension:ADSname:$data. When you open a normal file the default $DATA is read which is the data in the file itself. A normal file will be of the format filename.extension::$Data (Note there is no ADS). Imagine you had a text file full of passwords and you had attached it to explorer.exe, then to access the contents of passwords.txt file you would have to use explorer.exe:passwords.txt:$Data. You can even have ADS for a folder!! In fact any folder on a NTFS system. You could then store your passwords.txt file attached to C:\Windows!!

You can attach any number of files to any single file or folder. That means you could attach a 699 MB DvDrip AVI to a 4 MB Summer of 69.mp3 without increasing the size of your mp3 by a single byte!! Windows does not show the attached file in explorer or by any normal means. The whole 699 MB can be stored on to the hard disk (without anybody knowing) and retrieved later. Since ADS is not stored inside the parent file, the size of the mp3 remains the same!! Although disk space goes down by the same amount.

That kinda sounds far fetched right? Alright lets have a small demonstration. Lets use explorer.exe and passwords.txt

Open Notepad and type the following:
Orkut=h@ck3rz
Rediff=r3dm0nd123
facebook=!@#c3sium

These are web services and their respective passwords. You could type in anything you want. Then save the file as passwords.txt in C: drive.

Then go to Start >> Run >> cmd to open the command prompt. cd.. your way to C:\> then type the following:

C:\>type passwords.txt > C:\Windows\explorer.exe:passwords.txt

Delete the original passwords.txt file from C: drive. The above command is self explanatory but for all those who didnt grasp its entirety, heres how it works. The type command is a cmd internal command to display the contents of a file, so type [filename] will display the contents of the text file. The >, also called as the output redirection operator is used to redirect output from one command to another command or file. C:\Windows\explorer.exe:passwords.txt is the ADS to explorer.exe called Passwords.txt. Now your file is safe and since you have attached it to explorer.exe (highly unlikely to be deleted) you can sleep well.

To retrieve the text file or the data inside, you can again use the command prompt or notepad.

Using command prompt:
C:\>more < C:\Windows\explorer.exe:passwords.txt

More is used to display output one screen at a time. Conveniently type does not work to display file contents here. The <, also (you must have already guessed it) called the input redirection operator takes the file contents from the file and gives it to more so it is displayed a (screen) page at a time. To dump it back to a text file use:

C:\>echo | more < C:\Windows\explorer.exe:passwords.txt > Passwords.txt

This is slightly complicated. Echo is used to display whatever is given to it as an argument. Echo Hello will display Hello. The pipe (|) is used to pass the output of the more command to echo and the > is used to dump whatever got echoed to the text file Passwords.txt. Here is a simpler method.

Using notepad:
Go to Start >> Run and type the following.

Notepad C:\Windows\Explorer.exe:Passwords.txt

Notepad should open up displaying the contents of the file. You can then use File >> Save As to save it anywhere you want.

I went ahead and wrote a program that allows you to work with NTFS Alternare Data Streams (ADS) with ease. You can scan your whole hard disk for NTFS ADS, you can create, delete, modify and export streams easily. This application uses native Windows API and hence is pretty fast at it. The application called NTStream is available here
.

Ntstream

Since ADS is any data attached to another file, it will be deleted only if you delete the parent file or if you use a third party tool to delete it. Always remember the name of the data stream and the parent file to which you attached it. Creating data streams could take up valuable hard disk space (if you are planning to hide large files like movies etc.). You can use ADS to hide any type of data, even executable code. Although thats not a good administrative practice, it can be done. Viruses and worms like Email-Worm.Win32.Dumaru.a and Win2K.Stream use ADS to spread. Use ADS efficiently and non-maliciously, use it to your advantage.