• 0

Determine if file is critical system file, HOW


Question

I wanna code to know if file is critical system file (like CONFIG.SYS , NTDETECT.COM , autoexec.bat)

I tried to use code to get file attributes and see if the file has "System" attribute but i found files like autoexec.bat hasn't "system" attribute.

I try to use that C# code but it doesn't work too (Every Time it gives me "True" value)

 public static string isFileSystem(string FileName)
		{
			try
			{
			   Type oType = Type.GetTypeFromProgID("Shell.Application");
			   object objShell = Activator.CreateInstance(oType);
			   object objFolder = oType.InvokeMember("Namespace", System.Reflection.BindingFlags.InvokeMethod, null, objShell, new object[] { new FileInfo(FileName).DirectoryName });
			   object objFolderItem = oType.InvokeMember("ParseName", System.Reflection.BindingFlags.InvokeMethod, null, objFolder, new object[] { new FileInfo(FileName).Name });
			   return oType.InvokeMember("isFileSystem", System.Reflection.BindingFlags.GetProperty, null, objFolderItem , null).ToString();
			}
			catch { return ""; }
		}

The Same code in VB.NET (without Blinding Codes) is

 Public Shared Function isFileSystem(ByVal FileName As String) As String
		Try 
			 Set objShell = CreateObject("Shell.Application")
			 Set objFolder = objShell.Namespace(new FileInfo(FileName).DirectoryName)
			 Set objFolderItem = objFolder.ParseName(new FileInfo(FileName).Name)
			 Return objFolderItem.IsFileSystem.ToString
		Catch
			 Return ""
		End Try
	End Function

I don't know where is the error.

If you have any other code can do the same task without too long codes it'll be good.

12 answers to this question

Recommended Posts

  • 0

This should work in 1.1 or 2.0:

 
	internal class MyMainClass
	{
		public static void Main()
		{
			FileAttributes fas = File.GetAttributes(@"c:\pagefile.sys");
			FileAttributes fa = File.GetAttributes(@"c:\YServer.txt");
			// should be true
			Console.WriteLine("Is System? {0}", (fas & FileAttributes.System) > 0);
			// should be false
			Console.WriteLine("Is System? {0}", (fa & FileAttributes.System) > 0);
		}
	}

In VB

Imports System.IO
Module Module1

	Sub Main()
		Dim fas As FileAttribute
		Dim fa As FileAttribute

		fas = File.GetAttributes("c:\pagefile.sys")
		fa = File.GetAttributes("c:\YServer.txt")

		Console.WriteLine("Is System? {0}", (fas And FileAttribute.System) > 0)
		Console.WriteLine("Is System? {0}", (fa And FileAttribute.System) > 0)
	End Sub

End Module

Edited by azcodemonkey
  • 0
  N_Win_Member said:

Soryy but i think you didn't understand what i was saying.

There is some files like autoexec.bat has no system attributes althouugh it's critical system file.

HOW Can I solve that ?

That IsFileSystem property just determines if it's part of the Windows file system, which is why it returns true all the time.

There must be a way to determine it, but it looks as if it is undocumented. I'll dig around to see what I can find.

  • 0

hi ! Emm, I think i'm correct in saying this, but for Windows versions above 98(2000 and xp) Config.sys , Autoexec.bat are NOT critical system files and hence maybe not marked as system. But i don't think the file attribute 'System' is the way to go about it

take for example, the file (in WinXP) C:\Windows\System32\ntoskrnl.exe i guess we could call it System critical but it has no "System" attribute to it.

I think u should maintain a list of system files and compare from that !

  • 0

I think he means "system file" by the way files are hidden. config.sys and autoexec.bat are hidden in XP. If you uncheck Hide Protected Operating System Files, and select Show Hidden Files and Folders, they show up, and hide when vice versa. I'm kind of curious as to how that is done. So far, I cannot find anything that specifies which files are considered protected OS files.

  • 0

@azcodemonkey

but that would mean that the file i said "ntoskrnl.exe" is not a system file since it does not hide with the "hide protected operating system files"...in any case..i guess, to me maintaining a list of files that we think are system is the only option, i give up !!

  • 0

Well there's SfcIsFileProtected function:

  Quote
Determines whether the specified file is protected (by Windows File Protection). Applications should avoid replacing protected system files.

Sample code, C#:

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Text;
using System.Windows.Forms;
using System.Runtime.InteropServices;

namespace WindowsApplication1
{
	public partial class Form1 : Form
	{

		[DllImport("sfc.dll")]
		static extern int SfcIsFileProtected(int handle, [MarshalAs(UnmanagedType.LPWStr)] string path);

		public Form1()
		{
			InitializeComponent();
		}

		private void button1_Click(object sender, EventArgs e)
		{
			if (SfcIsFileProtected(0, textBox1.Text.ToString()) == 0)
			{
				MessageBox.Show("The: " + textBox1.Text + "\r\nNot protected");
			}
			else
			{
				MessageBox.Show("The: " + textBox1.Text + "\r\nIs protected");
			}
		}
	}
}

  • 0

Ahhh... The consistency of the Win32 API is astounding. :pinch: I don't think it's doable via the API, N_Win.

@Wilhelmus, I think that's for files that are stored in windows/system32/dllcache as part of the Windows File Protection scheme. But, good find, nonetheless.

@Andareed, I'm pretty sure that GetAttributesOf is the equivalent of using FileAttributes. If you only select Show hidden files and folders, config.sys/autoexec.bat/boot.ini, et al, don't show. They only show if you uncheck Hide protected operating system files(Recommended) as well. To boot, config.sys, autoexec.bat, etc, are only tagged as Archive, not Hidden nor System.

I think you're full on correct, ~InstaShock~. A list was actually my initial thought, and I figured it would be in the registry, but I cannot find a thing that declares config.sys as a critical file, which I agree with you on about it not being so.

N_Win, you may want to head over to SysInternals' forum and ask there. Those guys know everything. LOL

  • 0

If you check the description for IShellFolder::GetAttributesOf, for SFGAO_HIDDEN, it says the following:

  Quote
The item is hidden and should not be displayed unless the Show hidden files and folders option is enabled in Folder Settings.

You could try contacting a shell MVP to see if they can shed more light on how shell knows what files to hide.

  • 0

Sorry For my wait replay and Thanks for all these replies and tries. But We are still having the problem here.

First for Wilhelmus Replay that was taking about SfcIsFileProtected sub it doesn't work for all system files it only works with protected files.

About Andareed idea which i was trying to use from the beginning ( Using Shell Method ) but with less complicate way. i was tring to use isfilesystem property that i have found in the following Microsoft link http://msdn2.microsoft.com/en-us/ms723191.aspx It was giving true in each time.

Another way by using shell i found and is working properly but with too long codes can be found in the project http://www.codeproject.com/vb/net/ExpCombo.asp. There is an item called Cshitem in previous explorer project which you can give a path then it will give you a lot of this file or folder properties. By using property called 'IsFileSystem' (one Cshitem properties) you can determine if this file is critical system file and if windows will hide or not. But as I said That is too long and complicated way.

If anyone can fix the first code or have another small code, it will be so good.

Thanks

Edited by N_Win_Member
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • I hope Microsoft goes back to the Fisher Price XP look first.
    • >It is a fundamental change to how macOS looks and feels, which some Neowin readers are definitely not a fan of. Hehe. You link to one of my posts here, but I actually LOVE glass effects and have spent the last decade or so hacking Windows to be more like Vista's Aero Glass, etc. Not sure why you thought my post implied I didn't like it. I was referring more to Apple copying this from Windows. I wish MS would being more glass/acrylic/mica to W11 ASAP! Maybe they will...by copying Apple this time.
    • iPad, Phone and Watch just updated. Downloading this now for my MBA
    • Apple introduces macOS Tahoe with a new Phone app, revamped Spotlight, and more by David Uzondu The speculation can finally end, as the rumors about the name turned out to be completely true. At its Worldwide Developers Conference today, Apple officially christened the next version of its desktop operating system macOS Tahoe. This release, part of the new "26" family of operating systems like iOS 26, is bringing more than just a new name to the table. The most significant and immediate change is a system-wide visual redesign Apple is calling "Liquid Glass." Let's talk about this new design, because it is the first thing you will notice. Apple is taking the translucent, layered look from its visionOS and bringing it everywhere. It is a fundamental change to how macOS looks and feels, which some Neowin readers are definitely not a fan of. Sidebars, toolbars, and menus all have this frosted glass effect, where their color and texture shift based on the window or wallpaper behind them. The menu bar is now completely transparent, and Apple is also adding more customization. You can now change the color of folders, which is a feature people have wanted for nearly forever, and add little symbols or emojis to them. The bigger story for day-to-day use might be how much tighter the Mac and iPhone are becoming. Last year, macOS Sequoia saw the release of apps like the dedicated Passwords app, and this year, with Tahoe, we get a full-blown Phone app on the Mac. It is not just for getting call notifications anymore. You can see your recent calls, check your voicemail, and access your contacts list just like you would on your iPhone. New features like Call Screening, which can figure out who is calling before you answer, are also included. Live Activities from your iPhone, like the status of an Uber ride or a food delivery, will now show up right in your Mac's menu bar. Spotlight search is also getting a massive update. For years, Spotlight has been a simple tool for finding files and launching apps. Now, Apple is trying to turn it into an action center. You will be able to perform tasks directly from the search results, like creating a new note or sending an email, without ever opening the corresponding application. The search results themselves are supposed to be smarter and are no longer separated into rigid categories. Everything just shows up in one big list, ranked by what the system thinks is most relevant to you. Despite Apple's ongoing AI challenges, Apple Intelligence is getting new abilities. The AI features introduced last year are being expanded. A new Live Translation feature can translate text in Messages or audio during a phone call or FaceTime, all on the device, to maintain privacy. The Shortcuts app is also getting more powerful. You can now build automations that tap directly into Apple's AI models to do more complex tasks, like summarizing an audio recording of a lecture and comparing it to your typed notes. And yes, Apple is still trying to make gaming on the Mac a serious thing. A new dedicated app called Apple Games is being introduced. It acts as a central library for all your games, similar to launchers you might see on a PC. It also includes a new Game Overlay, which lets you mess with system settings or chat with friends without leaving your game. Apple announced that titles like Cyberpunk 2077, Crimson Desert, and Lies of P: Overture are on their way to the platform. Other mainstays are getting refreshed as well. Safari has a redesigned tab layout, Messages is getting polls, and the Journal app is finally making its way from the iPhone to the Mac. The first developer beta for macOS Tahoe is available today, June 9, 2025. A public beta is expected to follow next month, with the final version being released for free to everyone with a compatible Mac this fall. You can check out all the details in Apple's official macOS announcement on the Newsroom.
    • Google introduces new analytics tools in Classroom by David Uzondu Google has started the rollout of new analytics tools for Google Classroom, adding a bunch of ways for educators to monitor the activity of their students. This latest addition puts a new "Analytics" tab on class pages, which, according to Google, is meant to help teachers "see relevant insights on the class analytics page that alert them on how students are progressing and where they may need additional support." For example, on the new page, there might pop up a notification saying "3 students' grades increased over 25% since last month," or, on the flip side, "1 student turned in over half their assignments late in the last month." On the Classwork page, teachers can now see a number next to an assignment showing how many students have not even opened the attached files in Google Drive. For any teacher who has stared at a blank submission list, wondering if a student is struggling or just forgot. It shows who has not even started, letting teachers poke a student privately or nudge the whole class to get going. Google says insights are triggered by factors like approaching deadlines or performance issues, such as a student scoring below 70%. But here is the catch: these new tools are not for everyone. This is a premium feature, locked behind the paid Google Workspace for Education Plus license, so schools using the free version are completely out of luck. For those with a subscription, the student engagement metric that shows unopened Drive files is available right now. The main "Analytics" tab and its associated alerts, however, are on a slower schedule. Their extended rollout begins today. The company says the tab itself should show up by June 30, while the full set of insights will continue to appear, with everything expected to be in place by August 1, 2025. Super admins get access to this automatically and will have to decide which other education leaders and staff get to see all the new data.
  • Recent Achievements

    • Rookie
      CHUNWEI went up a rank
      Rookie
    • Enthusiast
      the420kid went up a rank
      Enthusiast
    • Conversation Starter
      NeoToad777 earned a badge
      Conversation Starter
    • Week One Done
      VicByrd earned a badge
      Week One Done
    • Reacting Well
      NeoToad777 earned a badge
      Reacting Well
  • Popular Contributors

    1. 1
      +primortal
      477
    2. 2
      +FloatingFatMan
      273
    3. 3
      ATLien_0
      256
    4. 4
      Edouard
      203
    5. 5
      snowy owl
      191
  • Tell a friend

    Love Neowin? Tell a friend!