Add/change comment without changing dates

[dmcmillen]

I know this has been discussed before. I believe this mirrors the behaviour of Explorer and understand that behavior, but there are times when I want to add/change a comment without affecting the modified and accessed dates. I can add/change the comment and then reset the dates if necessary. Is there a way in xplorer2 without changing the dates?

[nikos]

TOOLS > OPTIONS menu, Advanced property page, tick "Preserve modified date when setting comments"

[dmcmillen]

I have that checked, but it's intermittent. Just tested again on 2 files, one it didn't change and one it did. Any thoughts?

[nikos]

are these files of the same type or different? Which kind of file has its date changed when you set a comment?

[dmcmillen]

Both were mp4's. Properties of both files look identical otherwise.

[nikos]

that's very odd!
were the comments set properly for both files? Can you check the alternate streams using ACTIONS > ADS > VIEW STREAMS menu command in xplorer2?

[dmcmillen]

Not quite sure what I'm looking for. Help file says when a comment is added, a stream is added, but I'm not seeing that. Some files that I add a comment do not add any new stream and some do add (2) number 4 streams, but without the comment in the data. The mod date is not changed. So I'm not sure what behavior I'm looking for. For the files that do not add any streams, I cannot find where the comment is stored. I don't see it in the desktop.ini file in that directory.

For the original 2 files that I mentioned, the one that changed the mod date has 5 streams, a 3, 1, 4, 4, and a 7 stream. One of the "4" streams name is X2_AFS Comment and has the comment there. The file that did not change the mod date has 4 streams, a 3, 1, 4, and 7. There is no x2_AFS Comment or any data that has the comment.

Any info as to what the stream type means?

[nikos]

let's concentrate on the 2 mp4's you said. The one with the x2_AFS stream was the one that had its date changed or not?

[dmcmillen]

Yes, that's the one that changed the date.

[nikos]

ok I can see this problem with PNG files, it will be fixed

[dmcmillen]

I'm curious. On the mp4 file that did not change the date when the comment was added, there are 3 empty streams which I am to understand are original to the NTFS file, and the :Zone.Identifier:$DATA stream is an alternate stream that indicates it was downloaded. However, there is no x2_AFScomment:$DATA stream, so where did xplorer2 add the comment? Just trying to understand how this works.

[dmcmillen]

Oh, also meant to ask if there is a way to see the contents of the ADSs. Also, in checking for ADSs, I have a lot of :Zone.Identifier:$DATA streams that have a size of 4,096 which seems quite large and some are 32. If I'm scanning for something malicious, what am I looking for?

[nikos]

it doesn't make sense to me either why one MP4 would get an x2afs comment and the other something different. Perhaps the formats of the 2 files are different and the codec cannot handle them both

as for streams, you can use ACTIONS > ADS > SPLIT STREAMS command but most of the time there's not much to see. For an interesting trick see this deskrule advanced search option that compares the total size against the reported file size:

www.zabkat.com/blog/desktop-detective.htm

[dmcmillen]

Much downloaded video comes in as .flv, but most programs like Adobe After Effects cannot process .flv's, so you must use convert to a more useable format like mp4. However, in this case, these files came in as mp4's. Why would the codec prevent you from adding the x2afs ADS??

FYI, the file that changed the date and has the x2afs stream, MS Explorer does NOT see the comment. The file that did not change the date, MS Explorer does see the comment.

Two other questions:

(1) Where did you store the comment in the file that does not have an x2afs stream but does have the comment??
(2) Is there a tool that allows you to look at the content of the ADS? I have found tools that will tell you that ADS's are there and what there names and sizes are, but not the content of the ADS's.

[nikos]

(1) the codec stores it inside the file somewhere

(2) I just gave you the tool, xplorer2
extract the streams and look into them. Mostly they will be gibberish