CharlotteTheHarlot

Could be. I have never used it myself probably because I saw "indexing" in the description and I prefer brute force searches. It would probably have to be a hybrid though because if it indexes content, it would necessarily need more than just the $MFT and require accessing data sectors also ( well, unless it was a very small file completely held within the $MFT ). But I do believe the common comments that they optimized their engine faster than the indexers found in XP or Vista or 7 or whatever because they can be a nightmare. I always kill them first thing. Here is the link: VoidTools Everything Search Engine and the FAQ and Downloads.

Toshiba Windows 8 PCs get their own "Desktop Assist Program" ( NeoWin 2012-10-18 ) First commercial version of Start8 for Windows 8 released ( NeoWin 2012-10-19 ) Stardock's Start-menu replacement has gone gold. Toshiba says it has plans to enter the Start-Menu sweepstakes with their own launcher. The Fanboys are scornful. In fact one of them who is an administrator over there actually thinks Microsoft should stop OEM's ( and no doubt all of us ) from tampering with the perfection that is Windows 8 and Metro: "Yes, me too. So they can start to restrict the kind of crap OEMs install on people's computers. . . .". Later he adds: "If average users can't handle this change and it's "too much" for them, that is entirely their fault, and I'm glad Microsoft aren't harming my user experience just to cater to those people who can't be bothered to understand or learn a new interface.". Yep, we're doing it wrong. Microsoft holding Windows 8 training session at its stores ( NeoWin 2012-10-18 ) Okay, now let me understand this. Microsoft is willing to shell out for the huge cost of Windows 8 Metro clinics and seminars instead of just leaving the darned Start Menu in place. No doubt they spent some perfectly good development money on breaking and then disappearing the code needed to keep the Start Menu where it was all along. And at RTM they added a little hot-corners help thingie, visible once at first boot, but not a fancy full-fledged tutorial available on-demand, perhaps tied to the F1 HELP key or even on one of the tiles! This really is amateur hour. See a couple of months ago: The Windows 8 'tutorial' is a joke ( ZDNet 2012-08-22 ). Finally, a random example of why splattering the "Start-Menu" onto a full-screen of "live" tiles will evolve into the biggest setback for personal privacy and security we have ever seen ... My T-Mobile app for Windows in the Windows Store Preview ( apps.microsoft.com ) This is the proverbial tip-of-the-iceberg. Coming soon to a tile near you, billing and balance information from Visa, Mastercard and American Express. Statements from your bank and reports from your brokers and the Social Security Administration. All this data rendered in plain text on a computer screen or a single tap away. Hackers and Cyber-Criminals will have never had it so easy. The Fanboys will say "there is a lock screen!" Yeah, but there are live tiles after that, and what are the dummies gonna keep on their Phone/Tablet/Netbook/Laptop display, the lock screen or the live tiles? Microsoft is selling the live tiles hard and so are the Fanboys. There is only one way this thing can go and that is we wll now have a new class of devices even less secure than current laptops and cellphones - Windows 8 live tiles devices where the user is always on the Start Screen waiting for the Email or Facebook or some other thing to increment. I am surprised this has gotten very little attention. Wait 'til the first big virus hits. Yeah I know, they'll blame it on the desktop side.

Hi Joakim, Thanks for stopping in! You've got some very useful projects underway. Regarding Mft2csv, as I say I didn't run it yet, is it GUI or CLI? Also, Is the speed a consequence of AutoIt overhead? Is there documentation and can other modify the source ( with attribution )? What I am aiming for is a replacement DIR that uses the $MFT or other metadata, for both completeness sake ( all existing files ) and for speed. Preferably not CSV but plain text like DIR, or the best case scenario with an option for either. Is there any chance of someone adapting Mft2csv into these requirements? If you can think of any other candidates please let me know. P.S. has anyone tested the GnuWin32 NTFSPROGS files?

Microsoft Turns the Surface Tablet Into a Skateboard ( Tom's Hardware 2012-10-17 ) Sinofsky uses Surface as a skateboard, Tony Hawk is jealous ( NeoWin 2012-10-17 ) Will this be the next controversy? I mean, is it legitimate or another half-truth? Was it wheels attached to a Surface or merely a tablet strapped onto a skateboard? Did it still work? Where is the video? Why didn't they have Ballmer standing on it? With Surface looming, Microsoft fails to explain Windows 8 vs. Windows RT to consumers ( The Verge 2012-10-17 ) They even have some of the quotes from the salesmen in nice little graphics like this ... The thrust of the article is about the ignorance of salespeople in charge of selling the thing in the first place. No surprise considering how well managed Microsoft is these days. The larger point is the Windows RT ( and WP8 ) versus regular Windows 8 sharing the identical interface, not to menton the name "Windows" is very problematic. High confusion factor and pretty much par for the course for the same Microsoft braintrust that stepped into the Metro naming fiasco. I would go further and say it is intentional obfuscation and is one of the reasons the EULA has been changed to thwart class action lawsuits. Does anyone really believe that they are not counting on people mistakenly believing that RT will run x86 Windows software? It should have been a completely new name, not "Windows", because it is NOT "Windows" at all. It is disgraceful and deceptive and they are seriously sticking their necks out again. Another reason for the EULA change will be evident when novice computer users and n00bs see all the smiling people on the commercials happily swiping their screens and they then run out and buy the upgrade and go crazy poking and prodding their "legacy" displays wondering why the thing just doesn't work! I noted way upthread that we should watch the commercials for a: "DISCLAIMER: Touchscreen Display Required for Swiping" to see if their legal department isn't totally incompetent. The few videos and commercials I have seen so far do not indicate any disclaimer. Yet a third reason for the EULA change might be for those Darwin Award contenders that purchase desktop touchscreens and spend hours and hours reaching out and wonder why their arms have turned to Jello. IMHO, there is a lot of incompetence or shadiness in this whole thing. It is about the sale, the trend, the fad, but NOT the user. It really never has been, but it is getting worse. The net result of this experiment will be higher computer prices and less value for more money for the first time, ever. This Windows 8 thing must crash and burn for the good of everyone involved. That's what I think.

Here is another that I didn't see mentioned yet. NeoWin reports on another entry in the replacement Start Menu sweepstakes ... Pokki Menu by SweetLabs. ( original ) EDIT: updated image URL, and again

Who said everyone over there is a Fanboy? You're not the only one reading and posting at NeoWin. Some of us, like me have been there for a decade and are well-suited to recognize changes like when it has been over-run by generation Xbox spoiled children. So obviously the term "Fanboy Central" does not mean that everyone there is a Fanboy because I would have to be one also. Please develop a sense of humor, your blood pressure will thank you for it. For example here is a thread over there from about two months ago that isn't by a Fanboy. It is quite funny because the Fanboys that it lampoons all blindly jump in reveling in their cluelessness over the topic, which highlights their own typical Fanboy rebuttal to adults criticizing the forced Metro-only removed-StartMenu paradigm: "If you don't like it just pin your program to the taskbar and STFU!" How Pro Windows 8 users want Anti Windows 8 users to use Windows 8 ( NeoWin Forums 2012-08-09 ) A picture is worth a thousand words ... The responses are hilarious precisely because they don't get it. The image demonstrates exactly what they impulsively tell the so-called "haters" to do, yet they still cannot understand it! Cognitive Dissonance. EDIT: updated image URL, and again

Thanks Jaclaz. I was hoping you would throw out some ideas. I have no problem grabbing the metadata off disks, feeding them into programs, etc. I'm just trying to fine-tune the output listing to that narrow set of fields. RE: Mft2csv, I didn't mean to imply of any problem whatsoever, all I said was I hadn't tested it yet. There is no documentation I could find ( switches, etc ) and I perused the .au3 source and nothing was obvious. So I just wanted to be absolutely sure I had the instructions before testing and reporting on it. It's just the right thing to do. So I think you are saying Mft2csv is GUI not CLI, correct? If so, no switches to worry about! I will look into those others you mention as well. Please let me know if you come across any others ( DIR file list alternatives ). P.S. Actually a while back I googled for references to TzWorks and after eliminating links to their own website, amazingly there seemed to only be about 5 people in the world even aware of those tools. Not surprisingly, one of those people was You!

Microsoft reveals Surface RT pricing, starts at $499 for 32GB ( TechSpot 2012-10-16 ) Pricing for Microsoft Surface Tablets and Covers Revealed ( Tom's Hardware 2012-10-16 ) Well that is clear as mud! No, not for us who understand the geek speak, but for the other 99% that they are trying to reach. ~sigh~ Microsoft does the same thing with tangled prices and SKUs for their flagship software like Windows and Office, why shouldn't they create a mess with their toy tablet, err netbook, err tab-book, err whatever. Here is the mistake I think they made and how they made it. Some of the Windows 8 and Metro criticism made it into the Redmond boardroom and memories of Vista caused them to huddle and do that pricing thing on the low-end RT tablet by changing it from $599 with cover to $499 + $100. This way all the headlines today say "Surface Pricing Starts at $499". The next one up is $699 with cover, so it is frickin' obvious the lower one was originally $599 with cover! They really have contempt for their customers. Microsoft stock price nearly flat today after Surface reveal ( NeoWin 2012-10-16 ) Yeah, I know that it doesn't really mean anything, especially with MSFT resembling a flatlined EKG for a decade. But watching the fanboys have strokes is cheap entertainment. Especially when NeoWin, aka Fanboy Central, writes this ... The only way that thing will rise is when Ballmer is fired or resigns and Sinofsky follows him out the door.

[reserved]

[reserved]

-( As there is no forum just for NTFS and I needed to choose one, WinXP is as good as any. If there is a better choice please let me know and I'll ask the mods to move this. )- Background ... For some time this has been like a quest for the holy grail - obtaining a perfect file list off an NTFS volume. Specifically a tool that directly accesses the $metadata, bypassing NTFS and Windows API functions. Doing this allows the utility to list or copy any file on an NTFS volume, including those that might be in use or locked down or inaccessible from tangled ACL permissions. Consider a volume that is not in use, perhaps it is slaved in another computer for forensic analysis, accessing files through the $MFT ( Master File Table ) and other related metadata will allow access to all files not just those that are "allowed" by the host operating system which you are using to view this volume. Ideally, such a tool should be able to directly process the metadata like the $MFT even when it is copied to as a discrete file ( i.e., the ability to select an $MFT file to process ). So if you copy the $MFT as a file onto some other disk, you can then peruse it at your leisure, list it, extract data, etc. Finally, there is the added benefit that this method is much faster since it lacks the overhead found in the standard file system sequential method. What Am I Looking For? ... The thing I have personally most sought ( and the topic of this thread ) is a replacement DIR lister, one which does so using the $MFT and allows specific fields to be exported to or echoed as plain text ( like DIR ) or if necessary CSV ( which unfortunately would require extra post processing ). I have found a few programs that come close but so far none have all the requirements. In summary, I would like to be able to save a perfect file list of an NTFS volume with the following fields ... Modified Date/Time ( YYYY-MM-DD HH:MM:SS.xxx ) converted to local! Creation Date/Time ( YYYY-MM-DD HH:MM:SS.xxx ) converted to local! Accessed Date/Time ( YYYY-MM-DD HH:MM:SS.xxx ) converted to local! Size ( x,xxx ) with commas! FilePath\FileName ... displayed something like this ... Modified Created Accessed Size Name ----------------------- ----------------------- ----------------------- ------------------ ------------------------------ YYYY-MM-DD HH:MM:SS.xxx YYYY-MM-DD HH:MM:SS.xxx YYYY-MM-DD HH:MM:SS.xxx x,xxx,xxx,xxx C:\Temp\Test.gif YYYY-MM-DD HH:MM:SS.xxx YYYY-MM-DD HH:MM:SS.xxx YYYY-MM-DD HH:MM:SS.xxx x,xxx,xxx,xxx C:\Really Ridiculously Long Unnecessary Path\Really Ridiculously Long And Pointless Filename.With An Equally Ridiculously Long Extension Too! Why Do This? ... Such an output could then be sorted by columns: 1, 26, or 51 resulting in a log sorted by Modified, Created, or Accessed. Coupled with other data pulled from the NTFS journal and elsewhere, a very thorough forensic history can be utilized for running down malware and other problems, especially if this procedure is performed periodically and you have different logs to compare. "Sorting" in itself is NOT a requirement of a perfect DIR lister, in fact I would say that it is not desirable at all, because it is easily done post-process by dedicated sort utilities or a good editor like UltraEdit. "Formatting" of the data into a consistent output with predictable columns absolutely is a requirement. The ordering of those fields is also NOT critically important since you can easily sort by any particular column, however the path\filename absolutely MUST be the last field since it is the only one that has unknown total column width. The first three ( or six counting "time" separately ) are obviously fixed-width. For the file size column we always know the maximum possible size ( NTFS is 256 TB last time I checked ) but it can be assumed that the largest file will not be larger than the volume it resides on, so for example that field could be set to x,xxx,xxx,xxx,xxx maximum if the volume was 2TB. As a matter of fact, the first two examples below using the DIR command do exactly this because the padding shown allows for precisely x,xxx,xxx,x19,761 bytes. There are obviously many more possible output fields that could be extracted from the $MFT and saved to a drive file list, but I would like to confine them to only these few so that a log file would be more manageable when listing every single file present on a large volume. I should note that some of the utilities I have tested also can log slack space and deleted files, and other things that are important in forensic analysis. For example they can pull in and display file attributes and owners, but this means that extra processing occurs ( such as reading from other $metadata and specific file streams ) which will add to the overhead resulting in a longer time to finish making the list. So I figure that the utility already has enough to do, decoding each $MFT entry and output formatting when it converts to local time, decimal, punctuating, justifying, etc. KISS theory, Keep It Simple Stupid. In all examples below I have targeted one specific test file on a live NTFS system disk. Remote access to a volume, or parsing a standalone saved $MFT has NOT been tested yet. Important: My computers are always set to YYYY-MM-DD and 24-hour time format. This is to reduce the incidents of encountering MM/DD/YYYY or even the utterly ridiculous MM/DD/YY in various logs and results files because so many programs simply output their results using the system default rather than implementing the more sortable and much more sane method of YYYY-MM-DD. If your system is set to something different I believe you can use the DIR /4 parameter to adjust the year field but unless I am mistaken I believe there is nothing ( except changing the system time format ) that can fix the broken 12-hour time format which produces such insanity as 06:02 PM, or 12:59 AM followed immediately by 01:00 AM, or 11:59 PM followed immediately by 12:00 AM. These are sorting nightmares that make the time field practically useless and IMHO decreases the IQ of the human race in the process. Here is the default output from DIR ... EXAMPLE 01 ... DIR C:\Temp /a /s /x ... ( CMD.EXE ) Volume in drive C is xxxxxxxxxxx Volume Serial Number is xxxx-xxxx Directory of C:\Temp 2012-04-13 01:08 19,761 Test.gif 1 File(s) 19,761 bytes Aside from the fact that DIR is using Windows and NTFS API functions ( access limitations can be in effect ) and is very slow ( especially on entire volumes, at least on the first pass through before the metadata is cached ), however it does get part of the job done. With a little more development from Microsoft the DIR command could actually be quite useful, although certain files will never be displayed due to access limitations, so it will never be suitable for forensic use. Shortcomings: Well the time precision is too short ( no milliseconds ) and there is no option to list CREATED or ACCESSED date/times. But you can see that they aligned the output fields with sufficient padding for various file sizes so that the column widths are maintained. NOTE: This example uses the DIR /x parameter which adds padding for an extra column to hold any 8.3 SFN ( short filename ) that may exist for a particular NTFS file. EXAMPLE 02 ... DIR C:\Temp /a /s ... ( CMD.EXE and COMMAND.COM ) Volume in drive C is xxxxxxxxxxx Volume Serial Number is xxxx-xxxx Directory of C:\Temp 2012-04-13 01:08 19,761 Test.gif 1 File(s) 19,761 bytes Just for comparison sake, this is the output without the /x parameter so we see the missing field between size and filename. NOTE: Using COMMAND.COM exactly matches what CMD.EXE shows when the DIR /x parameter is left off. EXAMPLE 3 ... NtfsDir.exe C:\Temp -recurse 9999 >Output.txt ntfsdir ver: 1.01, Copyright (c) TZWorks LLC cmd: NtfsDir.exe C:\Temp -recurse 9999 last modified [UTC] MFT & seq num size name ----------------------- ------------- ---------- ------------------------- 04/13/2012 05:08:14.203 484565 91 20480 C:\Temp\Test.gif A promising 3rd party utility, NTFSDIR ( which does use $MFT and not the file system ) creates output that is somewhat similar to DIR, and displays the necessary milliseconds for the time precision. Shortcomings: Unfortunately it insists on using the MM/DD/YYYY date method ( but at least it is 4-digit ). This is not a deal-breaker though because it is still sortable using a good editor that allows 'key' column preferences ( in this case column 7 ) but that adds extra processing later. The time is left in UTC time format without conversion to local and although this will not affect sorting, it is a PITA when switching back and forth between a file list and a live system on local time. Another failure is the lack of commas for file sizes which also does not impact on sorting of course, but it is a cosmetic no-no that slows down interpretation of long numbers and therefore can encourage human errors. Finally, like DIR, there is no CREATED or ACCESSED date/times but instead its adds two $MFT specific fields of no particular value in this case. NOTE-1: The parameter -recurse 9999 ( equivalent to DIR /s ) is a kludge because unlike some of their utilities, this one does not have a -recurse 0 to signal infinite subdirectory recursion! 9999 is an arbitrary number I chose. This kludge is present in all examples that follow that have this bug or oversight. NOTE-2: IMPORTANT! there is a quirk or bug in NTFSDIR ( and some of their other utilities ) which inexplicably breaks scripting in a batch file for more than one command. In other words, if you place two consecutive NTFSDIR commands on different lines, only the first one will execute, after that the batch file terminates and the command windows closes! NOTE-3: The redirect parameter >Output.txt is not shown there in the output header but it was definitely included for the test to get the output into a file. EXAMPLE 4 ... NtfsDir.exe C:\Temp -recurse 9999 -csv >Output.txt ntfsdir ver: 1.01, Copyright (c) TZWorks LLC cmd: NtfsDir.exe C:\Temp -recurse 9999 -csv type, filename, symbolic link, size, attributes, MFT entry, sequence #, flags, cdate (stdinfo), ctime (stdinfo), mdate (stdinfo), mtime (stdinfo), MFT date (stdinfo), MFT time (stdinfo), adate (stdinfo), atime (stdinfo), time discrepancy, object ID file, C:\Temp\Test.gif, , 0x000000005000, 0x00002020, 0x0000000764d5, 0x005b, 0x0001, 04/13/2012, 05:08:14.109, 04/13/2012, 05:08:14.203, 10/01/2012, 23:45:50.062, 04/13/2012, 05:08:14.203, , Adding the -csv parameter to the previous example command results not only in CSV output ( comma separated values ), but it also yields some extra data fields. This one actually delivers all the required fields I want to see, albeit out of order. Shortcomings: Unfortunately it puts the filename first ( definite deal-breaker! ), and it uses hex for file size with no option for decimal conversion. One GIGANTIC mistake here is their using the barest CSV delimiter possible ", " ( comma,space ) which is certainly not helpful on file systems that allow exactly those two consecutive characters in a filename! Ideally there should be a selection of delimiter choice ( not specifically a criticism of these utilities, but any program that uses CSV or another output method ). Again, the redirect parameter >Output.txt is not shown there in the header but it was definitely included for the test to get the output into a file. And once again, dates are using the MM/DD/YYYY format and times are left as UTC. EXAMPLE 5 ... NtfsDir.exe C:\Temp -recurse 9999 -alldates -csv >Output.txt ntfsdir ver: 1.01, Copyright (c) TZWorks LLC cmd: NtfsDir.exe C:\Temp -recurse 9999 -csv type, filename, symbolic link, size, attributes, MFT entry, sequence #, flags, cdate (stdinfo), ctime (stdinfo), mdate (stdinfo), mtime (stdinfo), MFT date (stdinfo), MFT time (stdinfo), adate (stdinfo), atime (stdinfo), cdate (fn), ctime (fn), mdate (fn), mtime (fn), MFT date (fn), MFT time (fn), adate (fn), atime (fn), cdate (short fn), ctime (short fn), mdate (short fn), mtime (short fn), MFT date (short fn), MFT time (short fn), adate (short fn), atime (short fn), time discrepancy, object ID file, C:\Temp\Test.gif, , 0x000000005000, 0x00002020, 0x0000000764d5, 0x005b, 0x0001, 04/13/2012, 05:08:14.109, 04/13/2012, 05:08:14.203, 10/01/2012, 23:45:50.062, 04/13/2012, 05:08:14.203, 04/13/2012, 05:08:14.109, 04/13/2012, 05:08:14.156, 04/13/2012, 05:08:14.156, 04/13/2012, 05:08:14.156, , , , , , , , , , This is the same as the previous command, with -alldates added. As such, it also delivers all the required fields plus many more, with no ability to toggle any specific fields off. Shortcomings: As previously shown, it puts the filename first, it uses hex for everything with no option for decimal, dates in MM/DD/YYY, time in UTC. Also, the mistake is repeated here is using the CSV delimiter ", " ( comma,space ). And once again, the redirect parameter >Output.txt is not shown there in the header but it was definitely included for the test to get the output into a file. NOTE-1: That command line actually has the parameter -alldates, but the entry in the header for some reason does not show it ( some bug? ) nor does it ever seem to appear in any testing. NOTE-2: Confusingly, I have learned that contrary to the -? usage information, the parameter -csv alone returns some of the information that -alldates does. So, comparing examples 3 ( no switch ), 4 ( -csv ), and 5 ( -alldates -csv ) return an increasing amount of information for each file. The -csv switch does NOT simply convert output to CSV, it in fact adds more data as well. EXAMPLE 6 ... NtfsDir.exe C:\Temp -recurse 9999 -xml Output.txt <?xml version="1.0" encoding="utf-8"?> <logdata starting_path="C:\Temp" date="10/15/2012" time="04:06:08.531"> <data_entry><directory>C:\Temp\</directory> <filename>Test.gif</filename><dir/><size>20480</size><sym_link/><file_create_date>04/13/2012</file_create_date><file_create_time>05:08:14.109</file_create_time><file_altered_date>04/13/2012</file_altered_date><file_altered_time>05:08:14.203</file_altered_time><file_mft_changed_date>10/01/2012</file_mft_changed_date><file_mft_changed_time>23:45:50.062</file_mft_changed_time><file_accessed_date>04/13/2012</file_accessed_date><file_accessed_time>05:08:14.203</file_accessed_time><time_discrepancy>false</time_discrepancy><object_id/></data_entry> This is the same as example 4 but now using -xml instead of -csv. Shortcomings: Most of the same, MM/DD/YYYY, UTC, no commas, but at least the hex2dec was accomplished. This XML output has a peculiarity of breaking the path\filename into two separate lines though which introduces yet more extra post-processing. Since all the other XML fields were concatenated onto one line, it seems strange to leave that one hanging there. NOTE-1: Important to remember that the redirect symbol ">" is not required and causes this message: Error: option requires an output file: -xml <output file>, so it must be left off. ( possible bug? ) NOTE-2: This XML output does not produce any output header echoing the command line and copyright. EXAMPLE 7 ... NtfsDir.exe C:\Temp -recurse 9999 -alldates -xml Output.txt <?xml version="1.0" encoding="utf-8"?> <logdata starting_path="C:\Temp" date="10/15/2012" time="04:09:10.284"> <data_entry><directory>C:\Temp\</directory> <filename>Test.gif</filename><dir/><size>20480</size><sym_link/><file_create_date>04/13/2012</file_create_date><file_create_time>05:08:14.109</file_create_time><file_altered_date>04/13/2012</file_altered_date><file_altered_time>05:08:14.203</file_altered_time><file_mft_changed_date>10/01/2012</file_mft_changed_date><file_mft_changed_time>23:45:50.062</file_mft_changed_time><file_accessed_date>04/13/2012</file_accessed_date><file_accessed_time>05:08:14.203</file_accessed_time><name_create_date>04/13/2012</name_create_date><name_create_time>05:08:14.109</name_create_time><name_altered_date>04/13/2012</name_altered_date><name_altered_time>05:08:14.156</name_altered_time><name_mft_changed_date>04/13/2012</name_mft_changed_date><name_mft_changed_time>05:08:14.156</name_mft_changed_time><name_accessed_date>04/13/2012</name_accessed_date><name_accessed_time>05:08:14.156</name_accessed_time><shortname_create_date/><shortname_create_time/><shortname_altered_date/> <shortname_altered_time/><shortname_mft_changed_date/><shortname_mft_changed_time/><shortname_accessed_date/><shortname_accessed_time/><time_discrepancy>false</time_discrepancy><object_id/></data_entry> This is the same as example 5 but using -xml instead of -csv. It contains a few extra fields compared to the previous example 6 due to the additional parameter: -alldates. Shortcomings: All the previous shortcomings are present. Also note the lack of the redirect symbol ">" in the command line since it is using the -xml as explained above. EXAMPLE 8 ... NtfsWalk.exe -partition "c" -filter_name "test.gif" -out Output.txt cmdline: NtfsWalk.exe -partition "c" -filter_name "test.gif" -out Output.txt mft entry | seq | parent mft | type | ext | ref | date | time [UTC] | MACB | other info | path and filename | various data types 0x000764d5 | 91 | 0x00002e4c | file | gif | 1 | 04/13/2012 | 05:08:14.109 | si:[...b]; fn:[...b] | | [root]\Temp\Test.gif | [unnamed data : sz: 0x4d31 ] 0x000764d5 | 91 | 0x00002e4c | file | gif | 1 | 04/13/2012 | 05:08:14.156 | fn:[mac.] | | [root]\Temp\Test.gif | [unnamed data : sz: 0x4d31 ] 0x000764d5 | 91 | 0x00002e4c | file | gif | 1 | 04/13/2012 | 05:08:14.203 | si:[ma..] | | [root]\Temp\Test.gif | [unnamed data : sz: 0x4d31 ] 0x000764d5 | 91 | 0x00002e4c | file | gif | 1 | 10/01/2012 | 23:45:50.062 | si:[..c.] | | [root]\Temp\Test.gif | [unnamed data : sz: 0x4d31 ] This 3rd party utility NTFSWALK ( again from TzWorks ) also uses direct access to the $MFT metadata, but is drive-based rather than directory-based. In theory this is more appropriate for the task at hand which is listing the complete contents of a volume/drive. The output has a different style header only consisting of the executed command line. Shortcomings: What immediately prevents this tools as a file list solution is the fact that it breaks out each $MFT entry into separate output lines for each so-called inode, effectively generating a much longer list since each file almost always has several. If you look closely you can see that the four output lines for this same test file represent in this order: <file_create_time>, <name_altered_time>, <file_altered_time> and <file_mft_changed_time>. Another fatal feature can be seen in the default width for the "ext" field is far too small and will grow or truncate ( haven't tested yet ) when gigantic file extensions are encountered ( e.g., CLSID's ). Even worse is the fact that an extra field is displayed past FilePath\FileName which is a no-no because there are sure to be gigantic paths and filenames on any modern Windows installation ( .Net, SxS, etc ) and that last field will certainly be pushed out of alignment ( or the file name\path truncated ) and both are absolute deal-breakers. Additionally, there is the MM/DD/YYYY dates and UTC times. The file time precision is perfect since milliseconds are included in the output. The data is displayed in hex, but unlike previous examples this can be toggled away with a switch. There is also that very minor cosmetic bug in the header row output ( they just need to pad the word "ext" with an extra space ) which causes the column vertical divider to be misaligned only on the first row. NOTE: This tool, NTFSWALK *is* batch scriptable, in other words you can have more than one line using it and the batch file will proceed as expected, NOT terminating prematurely as it would with NTFSDIR. EXAMPLE 9 ... NtfsWalk.exe -partition "c" -filter_name "test.gif" -base10 -out Output.txt cmdline: NtfsWalk.exe -partition "c" -filter_name "test.gif" -base10 -out Output.txt mft entry | seq | parent mft | type | ext | ref | date | time [UTC] | MACB | other info | path and filename | various data types 484565 | 91 | 11852 | file | gif | 1 | 04/13/2012 | 05:08:14.109 | si:[...b]; fn:[...b] | | [root]\Temp\Test.gif | [unnamed data : sz: 0x4d31 ] 484565 | 91 | 11852 | file | gif | 1 | 04/13/2012 | 05:08:14.156 | fn:[mac.] | | [root]\Temp\Test.gif | [unnamed data : sz: 0x4d31 ] 484565 | 91 | 11852 | file | gif | 1 | 04/13/2012 | 05:08:14.203 | si:[ma..] | | [root]\Temp\Test.gif | [unnamed data : sz: 0x4d31 ] 484565 | 91 | 11852 | file | gif | 1 | 10/01/2012 | 23:45:50.062 | si:[..c.] | | [root]\Temp\Test.gif | [unnamed data : sz: 0x4d31 ] The exact same command with the added -base10 to switch the most of the hex to values decimal ( no commas unfortunately ). Shortcomings: All the other problems listed previously are present here. EXAMPLE 10 ... NtfsWalk.exe -partition "c" -filter_name "test.gif" -csv -out Output.txt cmdline: NtfsWalk.exe -partition "c" -filter_name "test.gif" -csv -out Output.txt mft entry,seqnum,parent mft,type,ext,ref,date,time [UTC],MACB,other info,path and filename,various data types, 0x000764d5,91,0x00002e4c,file,gif, 1,04/13/2012, 05:08:14.109,si:[...b]; fn:[...b],,[root]\Temp\Test.gif,[unnamed data : sz: 0x4d31 ], 0x000764d5,91,0x00002e4c,file,gif, 1,04/13/2012, 05:08:14.156,fn:[mac.],,[root]\Temp\Test.gif,[unnamed data : sz: 0x4d31 ], 0x000764d5,91,0x00002e4c,file,gif, 1,04/13/2012, 05:08:14.203,si:[ma..],,[root]\Temp\Test.gif,[unnamed data : sz: 0x4d31 ], 0x000764d5,91,0x00002e4c,file,gif, 1,10/01/2012, 23:45:50.062,si:[..c.],,[root]\Temp\Test.gif,[unnamed data : sz: 0x4d31 ], The same command as example 8 but adding the -csv switch. It gives us the exact same output with delimiters between the fields. However a GIGANTIC problem ( or bug ) surfaces here, the delimiter is sometimes ", " (comma,space ) and other times just "," ( comma ). Of course as mentioned earlier, commas are problematic when dealing with LFN's anyway. But a comma alone is even worse. Shortcomings: All the other problems listed previously are present here. EXAMPLE 11 ... NtfsWalk.exe -partition "c" -filter_name "test.gif" -base10 -csv -out Output.txt cmdline: NtfsWalk.exe -partition "c" -filter_name "test.gif" -base10 -csv -out Output.txt mft entry,seqnum,parent mft,type,ext,ref,date,time [UTC],MACB,other info,path and filename,various data types, 484565,91,11852,file,gif,1,04/13/2012, 05:08:14.109,si:[...b]; fn:[...b],,[root]\Temp\Test.gif,[unnamed data : sz: 0x4d31 ], 484565,91,11852,file,gif,1,04/13/2012, 05:08:14.156,fn:[mac.],,[root]\Temp\Test.gif,[unnamed data : sz: 0x4d31 ], 484565,91,11852,file,gif,1,04/13/2012, 05:08:14.203,si:[ma..],,[root]\Temp\Test.gif,[unnamed data : sz: 0x4d31 ], 484565,91,11852,file,gif,1,10/01/2012, 23:45:50.062,si:[..c.],,[root]\Temp\Test.gif,[unnamed data : sz: 0x4d31 ], The same command as example 9 but adding the -csv switch. Because of the -base10 switch in example 9 and this one, most of the hex values are now decimal. Previous comment in example 10 applies to this one as well. EXAMPLE 12 ... Wisp.exe -partition c -path c:\temp -level 9999 -base10 -all >Output.txt Name: c:\temp\Test.gif MFT Entry: 0x0000000764d5 [484565] MFT Sequence: 0x005b [91] Parent Entry: 0x000000002e4c [11852] Parent Sequence: 0x0001 [1] Entry: valid Modify time [utc]: 129787672942031250 [04/13/12 05:08:14.203] Access time [utc]: 129787672942031250 [04/13/12 05:08:14.203] MFTChanged time [utc]:129936087500625000 [10/01/12 23:45:50.062] Create time [utc]: 129787672941093750 [04/13/12 05:08:14.109] Size allocated: 0x00005000 [20480] Size used: 0x00004d31 [19761] Type entry: 0x00002020 [ARCHIVE, CONTENT_NOT_INDEXED] Source type: indx alloc WISP ( Windows INDX Slack Parser ) also from TzWorks is another potential directory lister. By design it parses INDX records found in different $metadata than the $MFT. Note that Microsoft apparently does not acknowledge this "INDX" terminology, instead preferring $I30 or $INDEX_ROOT and $INDEX_ALLOCATION. I don't know enough to say whether the data is exclusive to $I30 or whether it is linked in from $MFT or whether this utility access both locations to obtain the output. Regardless, the data produced is just as useful, in fact perfectly adequate if only it was formatted correctly! Unlike most earlier examples, an output header is not present. Shortcomings: The common theme of MM/DD/YYYY and UTC and others remain. But needless to say, this particular command is ill-suited for a directory listing without substantial post-processing since it used 14 lines output per file! NOTE-1: WISP prints all entries denoted as either "valid" or "slack" representing actual files or unused space respectively, and the utility offers the choice of corresponding switches -valid or -slack or -all. Also note that like NTFSDIR it makes subdirectory recursion difficult *and* it changes the switch name from -recurse to -level, and it specifically tells you that "recurse # levels [default is 0 levels]" which instead of meaning infinite, it means only the specified folder. So the 9999 kludge is also used here. NOTE-2: From the displayed output you can see the all required fields are there, and then some. Note that in these examples I jumped immediately to using the switches -base10 and -all, rather than reproducing much of what we already have seen previously. EXAMPLE 13 ... Wisp.exe -partition c -path c:\temp -level 9999 -base10 -all -csv >Output.txt [10/13/12 07:35:56.531 UTC] : Wisp.exe -partition "c" -path "c:\temp" -level "9999" -base10 -all -csv mft entry,mft seq,parent mft,type,modify date,modify time [utc],access date,access time [utc],mft date,mft time [utc],create date,create time [utc],dir/file,size alloc,size used,flags,name,slack comment 484565,91,11852,valid,04/13/2012, 05:08:14.203,04/13/2012, 05:08:14.203,10/01/2012, 23:45:50.062,04/13/2012, 05:08:14.109,file,20480,19761,0x00002020,c:\temp\Test.gif, The same command as example 12 but with the added switch -csv. The data is now contracted onto one line and with much post-processing it could be useful as a file list. Like earlier examples, the output header strips off the >Output.txt from the displayed command, but it is definitely there. Additionally, it embedded those quotes you see, but they were not in the batch file command. The actual executed command used in a batch file is listed after the example number. Shortcomings: The common theme of MM/DD/YYYY and UTC and others remain. The inconsistent delimiter problem is present, mostly using "," ( comma ) but sometimes ( in the time fields ) using ", " ( comma,space ). ConclusionAs you can see, there are many kinds of outputs just from these couple of utilities. The most frustrating problem is that these particular utilities use UTC time with no option to use local ( i.e., what you would see when accessing the disk in a file manager or viewing standard DIR listings ). So what I am wondering is if any others have looked into this and tested various tools and if possible, please share your suggestions and recommendations. More examples will be posted above as I test other utilities. Presently I am aware of two other possibilities which apparently also make use of the $MFT. One is found in the Gnuwin32 package called Ntfsprogs which contains Ntfsls.exe ( "list directory contents on an NTFS filesystem" ). The other possibility is called Mft2csv and is still in recent development authored by Joakim Schicht ( who if I'm not mistaken is a member here and also at reboot.pro aka boot-land.net ). The documentation link seems to be broken for Mft2csv, and the NtfsProgs package has no examples I can find. So I haven't yet tried either but will shortly once I find some example commands. Other suggestions are most welcome! The above mentioned Forensic Tools Prototypes by TzWorks are from a collection of 20 available at their website ( linked below ) and come as both 32 and 64-bit Windows binaries. Please don't let the mention of those few quirks or bugs color your opinion of them. There are some very impressive tools there. In particular the one called JP nicely parses the NTFS journal into a text log, CAFAE pulls common and unique artifacts from the registry, YARU has a GUI to view nearly impossible to access hives, and there are many more. Perhaps a thread detailing these promising tools would be an idea for later. Related Information ... Forensic Tools Prototypes ( TzWorks.net ) Reading MFT ( Social.Msdn.Microsoft ) MFT-Access - Reading & parsing the Master File Table on NTFS Filesystems ( AutoitScript.com ) mft2csv - Joakim Schicht ( Code.Google.com ) NtfsProgs for Windows ( GnuWin32 ) NTFS ( Wikipedia ) INDXParse ( Willi Ballenthin ) Originally Posted on 2012-10-17. Please report any typos or mistakes! 2012-10-17 ... EDIT: clarity, typos 2012-10-18 ... EDIT: TzWorks link was fixed. There is a strange bug in the forum ( or maybe Opera? ) when doing copy/paste of text in "Full Editor" causing random artifacts being inserted into the middle of words!

Analyst says Windows 8 expectations have 'plummet[ed]' ( NeoWin 2012-10-15 ) The Fanboys of course are frothing at the mouth. How dare they publish one article out of dozens that does not heap praise upon this abomination. From the Business Insider article ... Source: Business Insider Windows 8 used by zombie in Walking Dead TV ad ( NeoWin 2012-10-15 ) You gotta admit MicroZombies does have a real nice ring to it. Microsoft Windows 8 : So easy a Zombie can use it!

Does anybody know which tags do not collapse multiple spaces? Also, what is the character to display square brackets "[" to avoid it being interpreted as a tag

Dell will keep selling Windows 7 PCs after Windows 8 launch ( NeoWin 2012-10-13 ) And the Fanboys are not amused. Acer really doesn't like the Surface, continues to talk trash ( NeoWin 2012-10-13 ) And the Fanboys are extremely unhappy. PC Industry Concerned Over Lukewarm Windows 8 Interest ( Tom's Hardware 2012-10-13 ) Very few Fanboys here fortunately. Mostly adults. Special mention to this Dvorak column ... Make Way for Windows 8 ( PC Magazine 2012-10-10 ) IMHO he correctly points to the pedigree of "Live Tiles" back to Active Desktop ( although I would mention specifically the 'Channels' as the exact comparison, MSNBC feeds, etc ). In many ways, the Windows 8 Start Screen in Metro is definitely an evolution of this ( with some ripping off of the SysTray concept as well ). It seems obvious to me that Microsoft has had it stuck in their head to get this on the user desktop for many years. I believe the ultimate goal is for Microsoft to have dedicated ports directly to the computer user, like an intravenous drip. It must seem like the holy grail to them, a HSN ( home shopping network ) based in Redmond and synced to your wallet. Hence all the recent discussion about new advertising paradigms. Thanks anyway, not buying. Anyway, there is a must-see discussion in the comments ( starts about here ) between a fanboy and a normal grown-up. It really covers a lot of ground and they actually both compose themselves very well. Funny Note: the site uses nested comments, and if you ever wondered what happens when it runs to near the absolute limit then check it out! It gets down to about 8 chars wide. The link to the comment might not work correctly. Just expand "Load More Comments" and search for trip1ex to find it.

Contrast the discussion here with the one at Fanboy Central ... Microsoft may kill Windows Service Packs ( NeoWin 2012-10-12 ) I nominate this one for the Darwin Ballmer Award of the Day ... wtf?

Meanwhile ... Windows 8 pricing revealed through Newegg ( NeoWin 2012-10-12 ) Boy did they screw up again. Not in that price listing there, but in the details found at the article. What a mess of SKU decision making. What is hilarious is that even the NeoWin fanboys at the link are thoroughly confused, people who are faithfully using the Windows 8 RP and are bonafide Metro lovers are scratching their heads over how to purchase the thing. Note that these are still the promotional prices that "expire" sometime early next year. Thank God Microsoft removed the DVD decoders from Windows to keep the price low. How much is Microsoft betting on Windows 8? Nearly $2 billion, Forbes says ( NeoWin 2012-10-12 ) The sky's the limit I guess. Can't wait for the marketing blitz. Will they show people using a mouse and keyboard on their desktop PC's or will they allow them to run to the store with the mistaken perception that Windows 8 will magically convert their screen to touch ( you know this is gonna happen! ). Maybe this is the reason for the updated EULA that tries to prevent any class action lawsuits? Hmmm.

It's stunning isn't it? It is as if suicide was a contagious disease spreading from Redmond in all directions. Or maybe it is premeditated murder, with Windows 8 being a poison pill distributed among their Heaven's Gate cult of true-believers. Nokia reveals Euro pricing for Lumia 920 / 820 and accessories ( NeoWin 2012-10-12 ) Admittedly these are European prices ( France and UK ) which have embedded VAT, but it does not look like there is a sensible person anywwhere that is connected with Windows 8 pricing ( Phones, Tablets, AIO, Laptops, everything ). Holy crap! These guys must really listen to the Ballmer hype and take it seriously. How does Nokia even survive another disaster? ~sigh~ I don't know. Maybe next year it will be called MicroNokia

Groundhog day again with dozens more fanboy fluff pieces heralding Windows 8. I thought these were interesting. Windows 8 tablets are “priced way too high” ( NeoWin 2012-10-11 ) Ummm, yeah, no kidding! Favorite comment over there so far: "Guess failure is an option.....". Seriously, the only thing that Windows 8 is going to do is ratchet up the prices of everything. Thanks Microsoft. I am so glad you removed DVD decodeers from the operating system to save us money. The interesting thing about this article is that everyone is infatuated with Apple and their iPad, using this as the sole measure of comparison. None of them are aware that current deals on i7 laptops with large HDD and 17" screens are LESS expensive, and will remain so unless Microsoft manages to get them to install Windows 8 and add a touchscreen and other little gadgets, making them extinct and restocking the shelves with higher priced, LESS functional toys. It is practically a repeat of the HDD Thailand flood disaster ( or manufacturer collusion, you decide ), wiping out all existing stocks, and replacing them with a "new normal" price plateau. I'm gonna have to start recommending people to budget for new systems in the next few months because there is a chance that the long-time computer decreasing price / increasing performance trend will be coming to an abrupt halt. Thanks again Microsoft.! Samsung Galaxy Nexus sales ban reversed in the United States ( NeoWin 2012-10-11 ) Jeez, those executives that were crowing about that recent decision will have to start worrying again. This is the same case with the same judge ( with the suspicious jury foreman ), but this Tablet injunction was put in place before the trial even occurred. That injunction has now been reversed. The case itself is still under appeal and will probably also be overturned or heavily modified. This is good because MicroApple has been trying to clear the playing field of competition all over the world, trying to leave the sheeple with a choice between Apple and Microsoft devices. How cozy. Now those overpriced Windows 8 tablets and surfaces will have to really work for their market share. Microsoft may kill Windows Service Packs ( NeoWin 2012-10-11 ) This article appears to only be speculation, I can find no Microsoft sources so far. It is interesting because we have had a few similar threads here. At this one over at NeoWin, there are lots of fanboys saying 'good' and rooting for the death of service packs! Fanboy Intellectual Underachiever Award of the Day goes to: "I say good. Waiting years for a cumulative pack of fixes is a waste of bandwidth every time you install Windows." Say what?

That is simply offensive. Being a business weasel and not a tech guy, he doesn't even realize the giant crap he is taking on those devs that made that Herculean leap from Windows 3.x ( aka WinDOS ) to Win9x. That was a sea-change. It was an actual improvement in every way. It is not the same as producing Windows 8 ( 6.2 ) by tweaking and dumbing down "Windows 7" ( 6.1 ), which itself is a fine-tuned Vista ( 6.0 ), which was a tweaked mashup of WinXP ( 5.1 ) plus graphics rewrite and added bloat, which was a tweaked Win2k ( 5.0 ) plus bells and whistles, which was a fine-tuned evolution of a decade of NT and OS/2 research plus some Win9x user friendly features. That is a greatly simplified description, the point being that Win3.x carried little over to Win9x, they didn't just pile on code and hit 'compile' like they have been doing all through the Win9x branch and ever since Win2k on the NT branch. What those OS devs did in Win95 was marvelous, and the thing worked with only 8 MB of RAM and ran any program you could throw at it. Nothing like that is being achieved by these generation Xbox babies. So Ballmer is once again insulting the past successes they have achieved, like they often do with WinXP, and it is a clear indication of his unfitness to be involved with Windows. I can't speak for him but for the past 30 years we have used " x86 " purely in a generic sense, as encompassing the entire 8086 architecture. As long as Intel keeps the chip register and instruction compatible, with new bit widths being supersets of the previous, the x86 world remains ( and AMD64 got it pretty much right unlike other riscy forks ). Microsoft has been the one making forays into dropping off previous generations ( 16 bit, 32-bit ) at both the compiler and at the OS system file level and will continue doing so until people wake up and remember that backward compatibility is key. There is no excuse for an operating system incompatible with 16/32 bit x86 on a chip that is compatible. If they are incapable of doing their job or simply are using planned obsolescence ( can't say which is worse really ) then someone else needs to take over and write core OS's for " x86 " CPUs. Either that or split them up and send the OS div away from Redmond. Of course there is nothing stopping Intel from simply writing their own operating system, they have some useful compilers actually, and you never know what might happen as Microsoft morphs into MicroApple and starts courting ARM and other non-x86 architectures more than they have done in the past.

Another day and another dozen or two Windows 8 and related fluff articles at Fanboy Central. These were marginally interesting. Microsoft: 1.6 billion impressions for Windows 8 campaign ( NeoWin 2012-10-10 ) Yeah, I would say it's official. Microsoft is going to dive into their cash billions in a futile effort to put lipstick on this pig. "I can tell you, it's going to be difficult to tune in to your typical popular tv show or sports program and not see a Windows commercial in the next few months.". Can't wait. Jeez, if only they had spent more money on Vista. Most embarrasing fanboy of the day award: "Windows 8 will be amazing. If it fails its only because the "computer literate" person in the office/family/school would fill everybody's head up with garbage about "how much it sucks."" Hehe. Yeah, that's why it will fail. Children, you gotta love 'em. Microsoft training videos leak, tell you how to sell Windows 8 ( NeoWin 2012-10-10 ) Barforama. Three videos at the link designed for salesman, literally. Even has little popup "speak" bubbles to make sure the salesman trainee knows which are the talking points to parrot to the poor customer. Too bad they forgot to tell the salesmen to explain how to shutdown. Doh! Coming soon, training videos to explain how to install Tihiy's or XpClient's or other Start Menu and Explorer mods. Or better yet, explain the Win7 downgrade upgrade. One commenter had a great suggestion that the companies should begin recording their customer service calls! That would make for some great entertainment. An instant new Windows 8 Metro meme. Classic. Skeuomorphic design: Apple vs. good UX? ( NeoWin 2012-10-10 ) It occurred to me while reading this, that all this talk the past year about Skeuomorphism, a Sinofskyesque talking point, is really happening just as a feeble attempt to rationalize the doomed bonehead ideas from Team B&S. A year from now when the reality of fail sets in, these morons will point back to discussion about post-Skeuomorphism as an excuse for their damaging the Windows brand, discussion they actually initiated and astroturfed. Clever boys. It won't help. The internet remembers. Microsoft Windows 8 : Re-Imagining the PC ( With two snapped Apps. )

At least a dozen fluff pieces at Fanboy Central on Windows 8 today. This one shows four different spit and polished commercial advertisements ( videos ) apparently created by Microsoft for use in the coming campaign. Four Windows 8 video ads leak, show you how to use the OS ( NeoWin 2012-10-09 ) I watched all four and I am sure they won't help. They will miss the mark ironically because they are fast and fluid, and that does not match the attention span of the average Joe. Something else featured prominently that really jumps out of these videos is the fact that by design right on the Metro start screen, potential customers would have their private information jumping out of animated live tiles for anybody to see. And with a few swipes a stranger or a child could really do some damage. The Live Tiles are seen as the next big thing by Redmond, and they might be right if it were 3-5 years ago. But the customers are now well practiced and familiar with normal Windows, or Android or Mac/iOS on all manner of devices and to my knowledge were not clamoring for a company to design a GUI that removes more privacy. This splatting of your details on the screen has hardly been mentioned in the past year, but it is the biggest setback to personal privacy and we can thank the fads of the 'real world' or 'twitter' or 'facebook' paving the way for this. These gadgets will make fine toys, but no real adults will like this direction. Microsoft Board of Directors punishes Ballmer and Sinofsky for mis-steps. Not. ... Steve Ballmer still not paid as much as other Microsoft execs ( NeoWin 2012-10-09 ) Yep, the Board is really on it's toes. Imagine if they did a good job!

Well that didn't take long now, did it? Microsoft has rained on HSN's Windows 8 sales parade ( NeoWin 2012-10- 08 ) Home Shopping Network Starts Selling Windows 8 PCs Early ( Tom's Hardware 2012-10- 08 ) HSN.com Mistakenly Starts Selling Windows 8 PCs Early ( PC Magazine 2012-10- 08 ) First Windows 8 PCs appear early, crapware included ( ZDNet: Ed Bott 2012-10- 07 ) *** Original Source *** ( Credit for this story goes to Ed Bott at ZDNet, a detail I missed early this morning when it broke. ) The original HSN page now helpfully says: We were unable to find an item that matched your current selections.. Another pricing revealed ... Lenovo ThinkPad Tablet 2 to start at $629 ( TechRadar 2012-10- 08 ) Lenovo ThinkPad Tablet 2 pricing revealed ( NeoWin 2012-10- 08 ) Not much hard info though. It is a Windows 8 Tablet, and only the tablet. From what I can see it is cannot be the RT retard edition since it is an Intel Atom ( Clover Trail ), so let's really mess things up by calling it WoA - Windows on Atom! Seriously though, $629 at the minimum? The obvious conclusion to me is that all we can expect from the Windows 8 and Metro iteration is higher prices for less functionality, with strong emphasis on LESS. Microsoft has become Apple. MicroApple. Thanks a lot guys. And the desktop will become the last bastion of value for the discerning consumer. All the rest deserve their Darwin awards. Finally, I would be embarrassingly remiss to not mention this: Weird But Fun Windows 8 App: Iron Maiden Fan ( NeoWin 2012-10- 08 ) I had nothing to do with it.

Yeah, but a big "if" I would say. Disregarding the first photo ( doesn't even specify the screen size ) the laptops look like they have trackpads built in, but I guess we cannot rule out trackpad + touchscreen. But that last AIO PC specifically says "touchscreen" so I would assume that HSN is counting on that as a selling point and would necessarily include that in the laptop descriptions. UPDATE: I missed the "touchscreen" spec on the 3rd laptop, it is there obviously. It is a dual configuration. That's probably the only acceptable design for a laptop IMHO. My gut tells me they are simply existing Acer designs for Windows 7 laptops with Windows 8 shoehorned in. The deals there pretty much suck based solely on specs, but considering Acer has been pulling up the rear on overall quality and satisfaction for the past decade, the two Acer deals there really REALLY suck. Buying something off that page as it stands should qualify the sucker a nomination for a Darwin award. EDIT: mistake

Windows 8 Pro price listed at $188 through Volume Licensing ( NeoWin 2012-10-07 ) Sorry to repeat myself but aren't we lucky they removed the DVD MPEG2 Decoders to in an effort to save us money? Thanks Team B&S! Nice little dust-up in comments over there. All it takes someone to say: "not even free..." to get the fanboys all butt-hurt. One of the interesting things to watch unfold in the Windows 8 saga has been how Microsoft roped in Nokia as one of their flagships. They were in a bit of trouble prior to signing onto to this likely trainwreck, and many speculated Microsoft will just swallow up the company eventually ( MicroNokia has a bit of a ring to it ). Over at NeoWin they have very high hopes for Nokia and their Lumias since they must understand that an epic failure here will be a VERY bad sign for Windows 8. Up in Redmond, WP8 must certainly be considered a linchpin in their modern plan for world domination. What Microsoft has done thus far in the phone market has been nothing short of embarrassing, as a NeoWin article from October 3 drives home: ComScore: Microsoft's US mobile phone market share has dropped. For MicroNokia, early indications and word on the street has not been good at all. These are the danger ahead articles over at Fanboy Central just in the past month ... Nokia stock down 15% following Windows Phone announcements ( NeoWin 2012-09-05 ) Nokia apologizes for misleading Lumia PureView video ( NeoWin 2012-09-06 ) Nokia CEO: "No indications" Microsoft is making its own phone ( NeoWin 2012-10-02 ) Nokia confirms sell off Finland HQ buildings [update] ( NeoWin 2012-10-03 ) Major bank downgrades Nokia again, recommends break-up and sell-off ( NeoWin 2012-10-04 ) Nokia's VP of Product Marketing departs, investors dissapointed with 920 announcement ( NeoWin 2012-10-07 ) AT&T Lumias get reduced battery life estimates ( NeoWin 2012-10-07 ) I should point out that I personally have nothing against Nokia at all and would welcome more competition in all the tech markets. The 920 looks kinda nice except for the Metro GUI. But all the glamor shots have been of the same blind-man themed GUI with yellow tiles and white icons and text. It's as if they want to fail! This photo still exists at the website ... Good luck with that. Not really.

First Acer Windows 8 PCs on sale now at HSN.com ( NeoWin 2012-10-08 ) This is kinda interesting. One retailer may have jumped the gun and put some Windows 8 computers for sale online. HSN ( aka the Home Shopping Network ) has 5 of them listed on this page, still listed as of this writing. Since it will probably be scrubbed, I nicked the pertinent info ... I don't know about anyone else, but there isn't a thing there that strikes me as a good deal at all. 15" Laptop with i3 for $700 or 15" Laptop with i5 for $1000. WTF! Scroll up a few posts to see a 17" with i7 for $700. Jeez. I'll be the first to admit that we have no way of distinguishing the Microsoft Tax from the HSN Tax. But having said that, aren't we lucky they removed the DVD MPEG2 Decoders to in an effort to save us money? Thanks Team B&S! EDIT: yep, Microsoft got to them. See post # 1109 below.