Attribute 0x40 $OBJECT_ID
The purpose of the Object Id attribute is to identify individual files on a network.
This attribute is known as a resident attribute meaning that all the relevant file information only resides within the attribute itself.
An example of an Object ID attribute is detailed below:
This attribute contains a 128 bit identifier which is used to uniquely identify a file on a Windows computer and within a Windows network. Note that a service called Distributed Linked Tracking (DLT) will first need to be enabled (on the Domain Controller or DC) before the tracking of files can occur across a network. DLT information is stored within the Active Directory (AD) database on the Domain Controller.
Additional information…
The DLT client on a Windows computer is enabled by default. To see the service running open up Task Manager and navigate to Services. The service is called ‘TrkWks’ (trkwks.dll) and will be run under a generic windows process (svchost.exe). See image below:
The 128 bit identifier if expressed as a value is 2128. The actual value is 340,282,366,920,938,463,463,374,607,431,768,211,456 which is a lot!
That number can be expressed as 340 billion, billion, billion, billion or 340 undecillion. An undecillian contains 36 zero’s!
Interestingly 2128 is the same value calculated by the MD5 algorithm.
Introduction to Digital Forensics: Malware Analysis and Investigations
Introduction to Digital Forensics: Malware Analysis and Investigations
