I am currently working on a case where the suspect has a (large) number of suspect files, some of which are contained within the temporary 'CD Burning' folder on an XP machine.
On closer inspection of these files, they are not simple copies of other files waiting to be burned, but are actually hard links to files, some in the current user profile and others in a second profile.
I am a little stumped as to how they got there and wonder if anyone can shed some light on this.
I know that hard links can be created manually at the command line and is simple to do, but there are also a number of folders which hold the suspect files. It is my understanding that reparse points cannot be created easily in XP.
I know that the machine has Roxio 5 installed as well as the default windows cd burning software, so don't know if this has anything to do with it.
All suggestions gratefully received D
When you drag files into the CD folder in preparation for burning a CD, you actually copy them to a temporary folder in your local profile. Then, when you begin the actual burning process, Windows creates a separate image file.
Are the files in the temp folder?
http//
Yes they are, but I think I have worked it out…
When a file is sent to the cd drive for burning, the temporary file that is created is actually a hard link and not a simple copy of the original. Doh!
oops
Thanks for replying.