• 0

Determine if file is critical system file, HOW


Question

I wanna code to know if file is critical system file (like CONFIG.SYS , NTDETECT.COM , autoexec.bat)

I tried to use code to get file attributes and see if the file has "System" attribute but i found files like autoexec.bat hasn't "system" attribute.

I try to use that C# code but it doesn't work too (Every Time it gives me "True" value)

 public static string isFileSystem(string FileName)
		{
			try
			{
			   Type oType = Type.GetTypeFromProgID("Shell.Application");
			   object objShell = Activator.CreateInstance(oType);
			   object objFolder = oType.InvokeMember("Namespace", System.Reflection.BindingFlags.InvokeMethod, null, objShell, new object[] { new FileInfo(FileName).DirectoryName });
			   object objFolderItem = oType.InvokeMember("ParseName", System.Reflection.BindingFlags.InvokeMethod, null, objFolder, new object[] { new FileInfo(FileName).Name });
			   return oType.InvokeMember("isFileSystem", System.Reflection.BindingFlags.GetProperty, null, objFolderItem , null).ToString();
			}
			catch { return ""; }
		}

The Same code in VB.NET (without Blinding Codes) is

 Public Shared Function isFileSystem(ByVal FileName As String) As String
		Try 
			 Set objShell = CreateObject("Shell.Application")
			 Set objFolder = objShell.Namespace(new FileInfo(FileName).DirectoryName)
			 Set objFolderItem = objFolder.ParseName(new FileInfo(FileName).Name)
			 Return objFolderItem.IsFileSystem.ToString
		Catch
			 Return ""
		End Try
	End Function

I don't know where is the error.

If you have any other code can do the same task without too long codes it'll be good.

12 answers to this question

Recommended Posts

  • 0

This should work in 1.1 or 2.0:

 
	internal class MyMainClass
	{
		public static void Main()
		{
			FileAttributes fas = File.GetAttributes(@"c:\pagefile.sys");
			FileAttributes fa = File.GetAttributes(@"c:\YServer.txt");
			// should be true
			Console.WriteLine("Is System? {0}", (fas & FileAttributes.System) > 0);
			// should be false
			Console.WriteLine("Is System? {0}", (fa & FileAttributes.System) > 0);
		}
	}

In VB

Imports System.IO
Module Module1

	Sub Main()
		Dim fas As FileAttribute
		Dim fa As FileAttribute

		fas = File.GetAttributes("c:\pagefile.sys")
		fa = File.GetAttributes("c:\YServer.txt")

		Console.WriteLine("Is System? {0}", (fas And FileAttribute.System) > 0)
		Console.WriteLine("Is System? {0}", (fa And FileAttribute.System) > 0)
	End Sub

End Module

Edited by azcodemonkey
  • 0
  N_Win_Member said:

Soryy but i think you didn't understand what i was saying.

There is some files like autoexec.bat has no system attributes althouugh it's critical system file.

HOW Can I solve that ?

That IsFileSystem property just determines if it's part of the Windows file system, which is why it returns true all the time.

There must be a way to determine it, but it looks as if it is undocumented. I'll dig around to see what I can find.

  • 0

hi ! Emm, I think i'm correct in saying this, but for Windows versions above 98(2000 and xp) Config.sys , Autoexec.bat are NOT critical system files and hence maybe not marked as system. But i don't think the file attribute 'System' is the way to go about it

take for example, the file (in WinXP) C:\Windows\System32\ntoskrnl.exe i guess we could call it System critical but it has no "System" attribute to it.

I think u should maintain a list of system files and compare from that !

  • 0

I think he means "system file" by the way files are hidden. config.sys and autoexec.bat are hidden in XP. If you uncheck Hide Protected Operating System Files, and select Show Hidden Files and Folders, they show up, and hide when vice versa. I'm kind of curious as to how that is done. So far, I cannot find anything that specifies which files are considered protected OS files.

  • 0

@azcodemonkey

but that would mean that the file i said "ntoskrnl.exe" is not a system file since it does not hide with the "hide protected operating system files"...in any case..i guess, to me maintaining a list of files that we think are system is the only option, i give up !!

  • 0

Well there's SfcIsFileProtected function:

  Quote
Determines whether the specified file is protected (by Windows File Protection). Applications should avoid replacing protected system files.

Sample code, C#:

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Text;
using System.Windows.Forms;
using System.Runtime.InteropServices;

namespace WindowsApplication1
{
	public partial class Form1 : Form
	{

		[DllImport("sfc.dll")]
		static extern int SfcIsFileProtected(int handle, [MarshalAs(UnmanagedType.LPWStr)] string path);

		public Form1()
		{
			InitializeComponent();
		}

		private void button1_Click(object sender, EventArgs e)
		{
			if (SfcIsFileProtected(0, textBox1.Text.ToString()) == 0)
			{
				MessageBox.Show("The: " + textBox1.Text + "\r\nNot protected");
			}
			else
			{
				MessageBox.Show("The: " + textBox1.Text + "\r\nIs protected");
			}
		}
	}
}

  • 0

Ahhh... The consistency of the Win32 API is astounding. :pinch: I don't think it's doable via the API, N_Win.

@Wilhelmus, I think that's for files that are stored in windows/system32/dllcache as part of the Windows File Protection scheme. But, good find, nonetheless.

@Andareed, I'm pretty sure that GetAttributesOf is the equivalent of using FileAttributes. If you only select Show hidden files and folders, config.sys/autoexec.bat/boot.ini, et al, don't show. They only show if you uncheck Hide protected operating system files(Recommended) as well. To boot, config.sys, autoexec.bat, etc, are only tagged as Archive, not Hidden nor System.

I think you're full on correct, ~InstaShock~. A list was actually my initial thought, and I figured it would be in the registry, but I cannot find a thing that declares config.sys as a critical file, which I agree with you on about it not being so.

N_Win, you may want to head over to SysInternals' forum and ask there. Those guys know everything. LOL

  • 0

If you check the description for IShellFolder::GetAttributesOf, for SFGAO_HIDDEN, it says the following:

  Quote
The item is hidden and should not be displayed unless the Show hidden files and folders option is enabled in Folder Settings.

You could try contacting a shell MVP to see if they can shed more light on how shell knows what files to hide.

  • 0

Sorry For my wait replay and Thanks for all these replies and tries. But We are still having the problem here.

First for Wilhelmus Replay that was taking about SfcIsFileProtected sub it doesn't work for all system files it only works with protected files.

About Andareed idea which i was trying to use from the beginning ( Using Shell Method ) but with less complicate way. i was tring to use isfilesystem property that i have found in the following Microsoft link http://msdn2.microsoft.com/en-us/ms723191.aspx It was giving true in each time.

Another way by using shell i found and is working properly but with too long codes can be found in the project http://www.codeproject.com/vb/net/ExpCombo.asp. There is an item called Cshitem in previous explorer project which you can give a path then it will give you a lot of this file or folder properties. By using property called 'IsFileSystem' (one Cshitem properties) you can determine if this file is critical system file and if windows will hide or not. But as I said That is too long and complicated way.

If anyone can fix the first code or have another small code, it will be so good.

Thanks

Edited by N_Win_Member
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Gemini in Google Sheets can now generate fully editable charts by David Uzondu Back in January, Google introduced a feature in Google Sheets powered by Gemini that lets you ask the AI to create charts from your data. The problem was, these charts were just static pictures, slapped on top of your cells. You could not edit them, and they would not update if your data changed. Now, the company has upgraded the feature so you can edit the charts however you want, plus they stay synced with your data as it changes. The process is quite straightforward. You use the Gemini side panel and just type what you want, like "create a bar chart showing campaign performance by market." Gemini then builds the chart, and when you insert it, the chart appears in a completely new tab within your spreadsheet. From that new home, you have total control. You can change the title, tweak the colors, and adjust all the little details just like any normal chart you would build yourself. It is not a completely perfect system, however. The biggest catch is that the editable chart is linked to the data in that new tab, not your original data source. So if you want the chart to reflect new numbers, you have to update the data in the chart’s dedicated tab. This is a bit of a weird detour from how standard Sheets charts have always worked, where they update directly from the source cells. For certain, more complex chart types, Google also notes that Gemini might still fall back to spitting out a static image, so your mileage may vary. The full rollout began recently, with Google expecting it to reach everyone within one to three days. This update is available for a bunch of Google Workspace accounts, including Business Standard, Business Plus, Enterprise Standard, and Enterprise Plus. It is also included for anyone with a Google One AI Premium plan, which the company has since renamed to Google AI Pro and Ultra. If you are on one of the old Gemini Business or Enterprise add-ons that Google stopped selling back on January 15, 2025, you get this feature too. Just make sure your admin has the "Smart features and personalization" setting turned on, or none of this will work.
    • iOS feature updates are lacklustre. I know it’s difficult with a mature OS, but imagine the announcements without Liquid Glass. Pretty thin.
    • Should you buy the Kindle Scribe? What to know about Amazon's e-reader for notes and reading by Paul Hill We’re all familiar with the Amazon Kindle lineup of affordable e-readers, but did you know that Amazon has a Kindle for writing on too? That’s where the Kindle Scribe comes in. The Scribe is more notebook sized, rather than book sized and has the largest screen Amazon has ever included in a Kindle. With this device, Amazon is trying to expand the paper reading-like experience to paper writing-like. With the current discount, you can save up to 25%, with prices as low as $299.99. There are three models available: a 16GB, 32GB, and 64GB model. You cannot expand the storage so be sure to pick the size you’ll need from the get-go. The Kindle Scribe won’t be the perfect choice if all you want to do is read books, however, if you’re a student or professional who wants to take notes, or an avid reader that wants to make annotations, then this could be a good pick for you. What it does The Kindle Scribe features a large 10.2-inch glare-free display with a 300 ppi density. It comes with a Premium Pen that makes it feel like you’re writing on paper as you jot down your notes. To make writing easy, you get Active Canvas for in-book notes and a built-in notebook with templates. You can import and write on PDFs and documents via Send to Kindle, including sending directly from Word if you have a Microsoft 365 subscription. Once you have written out your notes, the Kindle Scribe allows you to summarize them using artificial intelligence. You can even customize the length and tone of your notes. You can also refine your notes by converting your handwritten words into a script font. One of the standout features of other Kindle devices is their spectacular battery life, and the Kindle Scribe promises the same. The battery will last you up to 12 weeks for reading and up to 3 weeks for writing. Furthermore, Amazon has used 18% recycled materials including 100% recycled aluminum parts, and it comes in fully recyclable packaging. Finally, and it shouldn’t really need mentioning, the Kindle Scribe has full access to the Kindle Store so you can quickly and easily gain access to all of the latest books. Should you buy it? If you are looking for a distraction free gadget to read books on and take notes then the Kindle Scribe is definitely worth considering now that it is at its lowest price to date. Students and professionals are two groups who might benefit the most from this model. If you’re just looking for a Kindle for reading on Amazon, there are other models that may be better such as the Paperwhite or Oasis. The Kindle Scribe is a pretty radical change for a Kindle device with its very large display and writing capabilities. If you’ve been waiting for something like this, then it may justify an upgrade from an older Kindle. If you do decide to buy, make sure to get enough storage from the get go. Amazon Kindle Scribe (16GB): $299.99 (Amazon US) / MSRP $399.99 Amazon Kindle Scribe (32GB): $319.99 (Amazon US) / MSRP $419.99 Amazon Kindle Scribe (64GB, Tungsten): $349.99 (Amazon US) / MSRP $449.99 Amazon Kindle Scribe (64GB, Metallic Jade): $349.99 (Amazon US) / MSRP $449.99 This Amazon deal is US-specific and not available in other regions unless specified. If you don't like it or want to look at more options, check out the Amazon US deals page here. Get Prime (SNAP), Prime Video, Audible Plus or Kindle / Music Unlimited. Free for 30 days. As an Amazon Associate, we earn from qualifying purchases.
    • They shouldn’t listen to stupid ideas and this is a stupid idea. Many issues can be fixed via the registry but not with general registry cleaners. Sometimes a value needs to be changed or a new key needs to be created or deleted but there is no way a general cleaner could make that distinction. Making daily backups of your system state is a better idea so if your system does start behaving differently you can revert to a previous date. System Restore used to be helpful in this area but doesn’t seem as reliable these days. A full registry restore is often helpful.
  • Recent Achievements

    • Week One Done
      IAMFLUXX earned a badge
      Week One Done
    • One Month Later
      Æhund earned a badge
      One Month Later
    • One Month Later
      CoolRaoul earned a badge
      One Month Later
    • First Post
      Kurotama earned a badge
      First Post
    • Collaborator
      Carltonbar earned a badge
      Collaborator
  • Popular Contributors

    1. 1
      +primortal
      506
    2. 2
      ATLien_0
      269
    3. 3
      +FloatingFatMan
      241
    4. 4
      +Edouard
      201
    5. 5
      snowy owl
      163
  • Tell a friend

    Love Neowin? Tell a friend!