file copies change trailing data on certain files?

[frank.secada]

I don't know if anyone has seen this here, but I noticed that after
running windows update in August (about 2-3 weeks ago), my backups were
failing for having too many files changing after they were copied into
a new directory.

The way I run backups, I add a step to restore files to a spare hard
drive and compare against the originals. usually, the result is that,
out of almost a million files, maybe two or three hundred differ, and
that can be explained by downloaded updates, changes to itunes or real
player libraries, software I'm writing or changes to documents, etc.
but after my latest backups, I'm finding thousands of files not
matching on compares. And these are files which haven't changed in a
long time. Like Java libraries, source samples or docs, etc.

I tested this without the backup, just copying files from one directory
to another, and found it was easy to reproduce just using xcopy. I ran
a posix 'cmp' on two copies of a .jpg file and found that the new one
was filled with bytes containing 'df'. I'm assuming that MS is padding
all data files with a set pattern, to prevent malicious code being
hidden there in a buffer overflow ?

Has anyone else seen this? Has MS published the nature of this change
and what filetypes it affects? Thanks much for the help

 

[KeithMail]

Can I ask you to look at a thread myself and a couple of others are having
in the newsgroup ..

microsoft.public.win2000.file_system
entitled
"Since weekend update, small files up to 4096 bytes get corrupt"

The file content change you describe (data changes to hex df is very
similar to a situation I have where a security KB was downloaded and applied
to Windows 2000 PCs ( I stress that only this o/s is affected AFAIK both
server and professional)
Essentially
When you have data on a Compressed volume and a file is under 4096 bytes,
the file MAY become altered in the manner you describe.
BUT I must say we have found this ONLY on win2000 (so far) and if you remove
that particular KB and reboot, the corruption does not re occur.
The corruption that HAS already occurred will stay, as the file is now
altered irrevocably but no further changes occur. Naturally I was very
concerned and have opened a Microsoft "case" and a test data sample has been
supplied.
Please confirm if your data is stored on a win2000 compressed volume, or not
and maybe this will help add some urgency to the discussions.

Keith