Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Quick scenario on a local Windows system.

Drive E: is formatted with NTFS has the following layout and permissions:

E:\                  (JohnDoe)
E:\folder            (Administrator)
E:\folder\subfolder  (JohnDoe)
  • JohnDoe has read/write access to the root directory.
  • JohnDoe has read/write access subfolder
  • JohnDoe does NOT have access to folder
  • JohnDoe does NOT have the ability to alter permissions.

Since JohnDoe cannot access folder and thus cannot list the contents, he must type in the path E:\folder\subfolder manually. There is is no "clickable" way to get from E:\ to subfolder.

Here's the question: Is there any way for JohnDoe to discover the existence and path of the accessible subfolder, without being able to list the contents of it's parent folder? Assume that he was not told the subfolder's name and that the permissions do not change from what is stated above.

For the sake of this problem, ignore the possibility of a brute-force attack to guess subfolder's name. Only non-brute-force methods are permitted.

share|improve this question
up vote 3 down vote accepted

NTFS does not provide a method to discover such remote sub-folders within itself, assuming that the intermediary folder is truly no-access. To get such intelligence you have to look beyond just the file-system, perhaps by interrogating other files for paths contained in the doucments, or any shortcuts laying about that reference such sub-directories.

Things get more interesting if JohnDoe has elevated access to the machine. At that point examining open file-handles can reveal the presence of hidden directories. If the directory is shared out, the list of open files for the share would also reveal their presence. These methods wouldn't work for 'normal' users though.

share|improve this answer
JohnDoe has zero access to the intermediary folder. – Unsigned Oct 7 '11 at 2:24
This is the correct answer for Windows – if you do not have the "Read" permission on folder, you cannot list its contents. But note that, even though one would expect folder\subfolder to be entirely inaccessible due to lack of the "Traverse" permission on folder (corresponding to the x bit on Unix), by default Windows gives everyone the "Bypass traverse checking" privilege and subfolder remains reachable if its full path is known. – grawity Oct 7 '11 at 5:56
@grawity: I know it's accessible. It's just that full path part. I'm curious if there is a way to determine the full path when it is not known. – Unsigned Oct 7 '11 at 16:41

Create a junction for subfolder in the root directory.


Use the command:

MkLink /j "E:\junction-to-subfolder" "E:\folder\subfolder"

Now JohnDoe can see and access that subfolder easily.

EDIT: To remove the junction without affecting the target, use:

RD "E:\junction-to-subfolder"
share|improve this answer
I don't think you understand the question. I am curious to know if JohnDoe can find the folder on his own without any junction. – Unsigned Oct 7 '11 at 2:23
Sorry, I read "how can" rather than "if". – Hand-E-Food Oct 7 '11 at 2:26
This should of been how the folders were implemented in the first place. This not only limits the discoverability of subfolders, but it also solves the "Bypass traverse issue". – surfasb Nov 23 '11 at 23:50

I've used a similar setup and it seems as though the users would stumble upon the directory. The problem in your case is now it would be accessed. If there is going to be a batch script or drive mapping, then the user would probably be able to discover it if they were savvy. I know in Windows you can hiding drive letters, but that may not be enough.

I would suggest if you don't want them to access it, don't give them permission, if possible. Use another account for that ever task you are doing (for example, running a batch script for backups or whatever).

It is hard to give more specific advice not knowing more on what you want to accomplish while not letting the user know. There may be a different way.

share|improve this answer
I'm not sure you understand the question. What do you mean "stumble upon"? There are no programs, shares, etc that reference this folder. – Unsigned Oct 7 '11 at 2:22
If the computer the user is using doesn't know of or use the share, the user doesn't know of the share, and no one will tell the user. Then I don't see how the user could discover it exists on their own. – Scott McClenning Oct 7 '11 at 2:34
It's not a share, it's a folder on a locally connected hard drive. The permissions were already stated above. I'm curious to know if there is any way of determining the folder's existence without being able to directly list the parent folder. – Unsigned Oct 7 '11 at 2:38
Your sentence "I've used a similar setup and it seems as though the users would stumble upon the directory" is a little ambiguous at best. – Unsigned Oct 7 '11 at 2:39
Your right, I misspoke, not share, but they wouldn't know of the "subfolder" in the share exists. That said, I still stand by that the shouldn't be able to discover it exists short of being told or brute-force (which you excluded). As far as being ambiguous, you didn't reveal much on why such a folder would need to exist. If the user shouldn't find it, why give them access to it? – Scott McClenning Oct 7 '11 at 3:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .