WINDOWS TIP: Had undeletable folder with I think Unicode right-to-left and trailing characters. Couldn't delete it even PowerShell. Always said doesn't exist.
Used 'dir /x' to see folder's 8.3 name, selected it with that, and used rmdir to delete it.
Wow what a trick. @JenMsft
-
Show this thread
-
Replying to @SwiftOnSecurity @JenMsft
Another fun trick you can use to delete files whose names are messed up is to open a handle to that file (or find a process that already has a handle to it, and inject into it) and call NtDeleteFile on it, with the handle value in the RootDirectory field of ObjectAttributes.
4 replies 1 retweet 37 likes -
yarh- that only moves the file into c:\\$extend\$deleted\fileid . this actually deletes a running file:pic.twitter.com/iGfJRDX5aJ
2 replies 0 retweets 10 likes -
interesting. I presume the fileid number is the same from nFileIndexLow/nFileIndexHigh in BY_HANDLE_FILE_INFORMATION?
2 replies 0 retweets 1 like -
to open by fileid- open any file on the same volume first- then do a relative file open to that with the file id option and fileid as name
1 reply 0 retweets 2 likes -
2 replies 0 retweets 3 likes -
ooh, useful.
1 reply 0 retweets 1 like -
yarh- and have some wonderfull edgecases, hard links have the same fileid so if you open by fileid you cannot rename nor delete- that would be indertiministic
1 reply 0 retweets 2 likes
but thats not all- there is two kinds of fileid- normal, and OBJECT_ID - objectid is assignable and arbetary- as long as correct nr of bits.pic.twitter.com/VyFT0F9IQA
-
-
0 replies 0 retweets 2 likesThanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.