While researching how to allocate space for empty Windows files, I bumped into this: [Wayback/Archive] windows – What does SetFileValidData doing ? what is the difference with SetEndOfFile? – Stack Overflow.
Interesting but dangerous: SetFileValidData allows setting the end of the “valid” file data to a point into the file without Windows pretending the content was zero-filled.
The big important thing here (a drawback for security, a blessing for adversaries): the file will incorporate data that was on disk before it got incorporated into the file, potentially leaking deleted data.
That’s why the SetFileValidData required at least the SE_MANAGE_VOLUME_NAME privilege.
QA content and salvaged/archived related links:
Read the rest of this entry »