Wednesday, May 21, 2014

Embedding Google Doc without left hand thumbnail/preview page view

I use Google Doc viewer with a number of clients and now Google seems to be limiting bandwidth with files that are hotlinked from other sites. So now I have had to host those files on Google Drive. However, embedding files from GDrive includes a the page preview pane.

Here's how to turn the Google Doc Viewer page preview pane off.















Here's a sample URL of a file hosted on Google Drive, named metadata.pdf (see above image)

https://docs.google.com/file/d/1E6msDpCEqwxlqbk4E96m-X3Lniw-YdFTF4hpLHdgAN8pgXHn_qZecYvCa51w/edit


For the sack of this article; The Google File ID is 
[Google File ID] = 1E6msDpCEqwxlqbk4E96m-X3Lniw-YdFTF4hpLHdgAN8pgXHn_qZecYvCa51w

from this standard Google Drive URL 


https://docs.google.com/file/d/[Google File ID]/edit

Cut and paste into this Google Document Viewer URL 

https://docs.google.com/viewer?srcid=[Google File ID]&pid=explorer&efh=false&a=v&chrome=false&embedded=true

then place the 
Google Document Viewer Embed <iframe>:

<iframe src="https://docs.google.com/viewer?srcid=[Google File ID]

&pid=explorer&efh=false&a=v&chrome=false&embedded=true" width="640px" height="480px"></iframe>


See example on my Solutions Tab

Sunday, May 18, 2014

Using AccessEnum to hunt down unknown file SIDs - User read/write with ???

AccessEnum is a Windows SysInternals tool that reliably list SIDs and user accounts on Windows 7,8+


"While the flexible security model employed by Windows NT-based systems allows full control over security and file permissions, managing permissions so that users have appropriate access to files, directories and Registry keys can be difficult. There's no built-in way to quickly view user accesses to a tree of directories or keys. AccessEnum gives you a full view of your file system and Registry security settings in seconds, making it the ideal tool for helping you for security holes and lock down permissions where necessary." Download AccessEnum

Dowload and run AccessEnum with elevated priveledes and you typically see some positive results:

click large

When I ran AccessEnum on C:\ (root), it revealed some questionable ??? read / write users.



click large
Right-click on the highlighted file reveals;

click large






















the Current Owner: Unable to display current owner. I tried the running icacls in a windows cmd prompt;

PS C:\>ICACLS "C:\windows\winsxs\temp\pendingrenames\01b8c129d167cf01b5070000ec288829.install.ins" /reset /T /C
and it returned Access is denied.

click large




So how do gain access to this file?

Solution - Just drop all current owner and re-create the owners.

click large































Right click, choose Security Tab, Choose Continue which pop-ups another window in which you can Add a good known account, mainly you.

One I did this I could see the file contents of *.install.ins

click large
This file seems innocuous enough, but I am satisfied that I know who controls it now and its not a hacked account.

Now running both of these script worked to reset the the ACL on this file

Windows CMD (Elevated) Script - Download Raw - See Original at wastebin.com - UI upgrade by :)
  1. ICACLS "C:\path\to\folder\filename.extension" /reset /T /C

Running this script add back inheritance to ACL for that directory.

Windows CMD (Elevated) Script - Download Raw - See Original at wastebin.com - UI upgrade by :)
  1. ICACLS "C:\path\to\folder\filename.extension" /inheritance:e /T /C

The result is if you right click on the file you get the correct ACL Group and User Names.
Note: This file name is incorrect the above got deleted but this has same ACL.
click large



Friday, May 9, 2014

How to determine the Windows Master File Table (MFT) Size

In my series of articles related to Windows Master File Table (MFT),  let's understand how to get this size of MFT on you disk.

The common approach is to issue the following command

fsutil fsinfo ntfsinfo C:

This yields, and we can see the field label MFT Valid Data Length, but for busy administrators this hex value is takes to much time to deal with.


Luckily for the excellent team at Sysinternals produced a tool to get around these hexadecimal numbers.

NTFSInfo is a little applet that shows you information about NTFS volumes. Its dump includes the size of a drive's allocation units, where key NTFS files are located, and the sizes of the NTFS metadata files on the volume. This information is typically of little more than curiosity value, but NTFSInfo does show some interesting things. For example, you've probably heard about the NTFS equivalent of the FAT file system's File Allocation Table. Its called the Master File Table (MFT), and it is made up of constant sized records that describe the location of all the files and directories on the drive. What's surprising about the MFT is that it is managed as a file, just like any other.

Download NTFSInfo, save in C:\windows\system32 path, so you can run it from the command line as Administrator

ntfsinfo C:

This yields 


From here we can see this drive has a MFT Size of 160 MB out of out of 129.6 Gb, leaving 
126.99 Gb of space that can be used. Roughly 0.124 % of the drive space.