NTFS Permissions - Folders and subfolders

Question

Quick scenario on a local Windows system.

Drive E: is formatted with NTFS has the following layout and permissions:

E:\                  (JohnDoe)
E:\folder            (Administrator)
E:\folder\subfolder  (JohnDoe)

• JohnDoe has read/write access to the root directory.
• JohnDoe has read/write access subfolder
• JohnDoe does NOT have access to folder
• JohnDoe does NOT have the ability to alter permissions.

Since JohnDoe cannot access folder and thus cannot list the contents, he must type in the path E:\folder\subfolder manually. There is is no "clickable" way to get from E:\ to subfolder.

Here's the question: Is there any way for JohnDoe to discover the existence and path of the accessible subfolder, without being able to list the contents of it's parent folder? Assume that he was not told the subfolder's name and that the permissions do not change from what is stated above.

_{For the sake of this problem, ignore the possibility of a brute-force attack to guess subfolder's name. Only non-brute-force methods are permitted.}

Answer 1

NTFS does not provide a method to discover such remote sub-folders within itself, assuming that the intermediary folder is truly no-access. To get such intelligence you have to look beyond just the file-system, perhaps by interrogating other files for paths contained in the doucments, or any shortcuts laying about that reference such sub-directories.

Things get more interesting if JohnDoe has elevated access to the machine. At that point examining open file-handles can reveal the presence of hidden directories. If the directory is shared out, the list of open files for the share would also reveal their presence. These methods wouldn't work for 'normal' users though.

Answer 2

I've used a similar setup and it seems as though the users would stumble upon the directory. The problem in your case is now it would be accessed. If there is going to be a batch script or drive mapping, then the user would probably be able to discover it if they were savvy. I know in Windows you can hiding drive letters, but that may not be enough.

I would suggest if you don't want them to access it, don't give them permission, if possible. Use another account for that ever task you are doing (for example, running a batch script for backups or whatever).

It is hard to give more specific advice not knowing more on what you want to accomplish while not letting the user know. There may be a different way.

Answer 3

Create a junction for subfolder in the root directory.

E:\
E:\folder
E:\folder\subfolder
E:\junction-to-subfolder

Use the command:

MkLink /j "E:\junction-to-subfolder" "E:\folder\subfolder"

Now JohnDoe can see and access that subfolder easily.

EDIT: To remove the junction without affecting the target, use:

RD "E:\junction-to-subfolder"