2 Replies Latest reply on Sep 21, 2017 1:14 PM by tortiz96

    Extended Attributes, Alternate Data Streams, and ODB$ folder

    nicholas.klebs

      Looking to get further information on: Extended Attributes (EA), Alternate Data Streams (ADS), and meta-files stored in the ODB$ folder - as they relates to DLPe.

      Is the EA, ADS, and ODB$ folder the mechanism that stores files that have been "tagged" using a DLP Tagging Rule ?

      If Tagging Rules are not being utilized; then a file should not have its EA or ADS modified by DLPe?

      If Tagging Rules are not being utilized; then meta-files and the ODB$ folder should not be utilized by DLPe?

      Are there utilities to view the ADS or EA of a file?

      Where is the ODB$ folder located?  Is there a way to view the folder and its contents?

       

      Trying to understand an issue that I have observed occasionally with transferring files to NAS.

      Some files that are in scope for a File Share Protection Rule generate an error when being transferred to a file share hosted by NAS.

      Initially the files transfer successfully, but something eventually happens to the file that causes the files to stop transferring and a file copy error occurs (screenshot below).

      I was hoping to troubleshoot the file transfer issue to see if it is related to the EA, ADS, or meta-file in the ODB$ folder.

       

        • 1. Re: Extended Attributes, Alternate Data Streams, and ODB$ folder
          hhoang

          A definitive answer would be in a packet capture.  This is an example of a similar scenario with a different NAS server that was filtered for SMB traffic:

           

          The request is attempting to attach DLPe's extended attributes (i.e. tag data):

           

          SMB2_FILE_FULL_EA_INFO

          EA: MCAFEEDLPATTRIBUTES := OPG?...

          Next Offset: 0

          EA Flags: 0x00

          EA Name Length: 19

          EA Data Length: 3080

          EA Name: McAfeeDlpAttributes

          EA Data: 4f5047a1050000000000000346020000ed56db6adb40103d...

           

           

           

          NAS server response:

           

          NT Status: STATUS_NOT_SUPPORTED (0xc00000bb)

          SetInfo Response (0x11)

          [Class: FILE_INFO (0x01)]

          [InfoLevel: SMB2_FILE_FULL_EA_INFO (0x0f)]

           

           

           

          Ultimately, it is an issue with the NAS server is handling/rejecting the extended attributes request.  You can remove the tags from the files and then try re-transferring to the NAS or disable the EA option in your policy to confirm.

          • 2. Re: Extended Attributes, Alternate Data Streams, and ODB$ folder
            tortiz96

            Hi I'm getting the same error when copying certain files to our Hiatchii NAS. Did you ever find out what was causing the 0X80070032 error. Thanks