Looking to get further information on: Extended Attributes (EA), Alternate Data Streams (ADS), and meta-files stored in the ODB$ folder - as they relates to DLPe.
Is the EA, ADS, and ODB$ folder the mechanism that stores files that have been "tagged" using a DLP Tagging Rule ?
If Tagging Rules are not being utilized; then a file should not have its EA or ADS modified by DLPe?
If Tagging Rules are not being utilized; then meta-files and the ODB$ folder should not be utilized by DLPe?
Are there utilities to view the ADS or EA of a file?
Where is the ODB$ folder located? Is there a way to view the folder and its contents?
Trying to understand an issue that I have observed occasionally with transferring files to NAS.
Some files that are in scope for a File Share Protection Rule generate an error when being transferred to a file share hosted by NAS.
Initially the files transfer successfully, but something eventually happens to the file that causes the files to stop transferring and a file copy error occurs (screenshot below).
I was hoping to troubleshoot the file transfer issue to see if it is related to the EA, ADS, or meta-file in the ODB$ folder.
A definitive answer would be in a packet capture. This is an example of a similar scenario with a different NAS server that was filtered for SMB traffic:
The request is attempting to attach DLPe's extended attributes (i.e. tag data):
EA: MCAFEEDLPATTRIBUTES := OPG?...
Next Offset: 0
EA Flags: 0x00
EA Name Length: 19
EA Data Length: 3080
EA Name: McAfeeDlpAttributes
EA Data: 4f5047a1050000000000000346020000ed56db6adb40103d...
NAS server response:
NT Status: STATUS_NOT_SUPPORTED (0xc00000bb)
SetInfo Response (0x11)
[Class: FILE_INFO (0x01)]
[InfoLevel: SMB2_FILE_FULL_EA_INFO (0x0f)]
Ultimately, it is an issue with the NAS server is handling/rejecting the extended attributes request. You can remove the tags from the files and then try re-transferring to the NAS or disable the EA option in your policy to confirm.
Hi I'm getting the same error when copying certain files to our Hiatchii NAS. Did you ever find out what was causing the 0X80070032 error. Thanks