-   Linux - General (
-   -   Windows XP hidden user (volume) in Documents and Settings folder (

crions 08-26-2008 03:53 PM

Windows XP hidden user (volume) in Documents and Settings folder
I just got into something very new for me...
I am used (and every one) to mount windows partitions (FAT/NTFS) in linux and do some work with it as long as I know linux.

I have one computer running windows XP with "John Doe" user, I know that the users files are at "c:\documents and settings\john doe\" and I check it with the good old DOS prompt... fine.

When I reboot the machine (live linux CD) I can see all partitions and the "C" drive. But the directory "John Doe" is missing!!! I tried to find it (or one of its components) by using:

find -iname "*file*"

...And nothing! I can see the files I move to the C: root, but my username is missing/hidden.

Does anyone knows what is this all about???
Any hidden volume file here?

Mr. C. 08-26-2008 09:33 PM

Why would you expect the case-insensitive pattern "*file*" to find C:\Documents and Settings\John Doe ? Do you have some file below that directory whose name contains "file" that you expect to be found?

Why not just navigate the NTFS file system and look under Documents and Settings?

crions 08-28-2008 08:14 PM

Yes, that is the idea but...
Yes! That is what I usually do. And it works fine in Linux.
This is really bizarre and new for me.

When I boot the machine in Windows(NTFS partition) I CAN SEE the user I am logged in and I create a file "findmeplease.txt" in my documents folder. I can see the hidden directories "Local Settings", "Cookies" among others trough the gold old dos <dir /as> command.

So far, nothing new...

I remove this harddrive (or boot with a Knoopix/Slax live cd) and plug it into my ubuntu machine (NTFS enable and used with other hard disks fine).

Where did the user directory (that is suposed to be in "Documents and Settings") went to???

Ok SmartUser you move it, no problem I will find it with my previous "findmeplease.txt" file...

cd /mnt/mysteriousvolume
find -iname "findmeplease.txt"

What? Let me check the folder again... :tisk:

Something weird appears: In the "Documents and Settings" folders there are 2 new folders:
"Network Service" and "Local Service"
Those folders (Strangely) DO NOT APPEAR when the I boot windows.

I seems some mount like volume control linux clone stuff, but I've never seen that before.

This is currently happening in a Toshiba M45 notebook.
I've checked for security software and could not find anything.
I haven't done a binary grep yet.

Mr. C. 08-28-2008 08:44 PM

The folders Network Service, Local Service, and Default User are hidden folders under Documents and Settings in Windows. Unless you set Windows to show Hidden folders, you won't normally see them. Nothing odd here.

I'm still not clear. What folders do you see under Documents and Settings when mounted in Linux?

crions 08-28-2008 09:35 PM

My Dear Friend,

I don't even set it to show the hidden files because I use the COMMAND PROMPT and the command: dir /ah
That command must show the "hidden folders" and it does! Test it yourself.

I am familiar with DOS commands long before Windows GUI. I would not create this topic if this was not weird enough.

And even if you're right about the "show hidden files" ( that I don't need to use) the user folder is still missing from the drive.

crions 08-28-2008 09:42 PM


In Windows with dir /a :

All users
Default user
John Doe

In Linux (ubuntu/slackware/knoppix - yes I tested all) with ls -lha:
All users
Default user
Local Services
Network Services

Yes: It is twisting my mind too.

All times are GMT -5. The time now is 05:57 PM.