查找所有文件，无论权限如何（Windows XP、C#）
我需要查找硬盘驱动器上的所有文件（在 C: 分区中），无论权限如何。 （Windows XP Pro，使用 C#）
在之前的一个问题中，我被告知：
无法查看“C:\System Volume Inforamtion”文件夹，因为它仅分配给 SYSTEM 用户。为了看到它的内部，你需要拥有它。但是，出于安全原因，不建议这样做。 – 亚历克斯·门德斯
我使用 Windows 已有多年，这是我第一次听说 SYSTEM 用户（这解释了我过去遇到的许多挫折）。我曾假设“管理员”类似于 UNIX 中的“root”用户，可以访问所有内容。
在 Windows 中，是否存在拥有一切的最终用户？
如果是，那么该用户是谁？
如果是这样，我如何以该用户身份运行我的 C# 程序以便可以看到所有文件？
如果没有，还有其他方法吗？ （其他程序也可以这样做。）
I have a need to find ALL files on my hard drive (in the C: partition), regardless of permissions.
(Windows XP Pro, using C#)
In an earlier question, I was told:
The "C:\System Volume Inforamtion" folder cannot be viewed because it is assigned only to the SYSTEM user. In order to see inside of it you need to take ownership of it. However, this is not recommended for security reasons. – Alex Mendez
I've worked with Windows for years, and this is the first time that I have heard about a SYSTEM user (which explains many frustrations I have had in the past). I had assumed that the "Administrator" was similar to the "root" user in UNIX, that has access to everything.
In Windows, is there an ultimate user that owns EVERYTHING?
If so, who is that user?
If so, how do I run my C# program as that user so I can see all the files?
If not, is there some other method? (Other programs do it.)
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
我相信
FILE_FLAG_BACKUP_SEMANTICS< /a> 基本上可以做你需要的事情。I believe
FILE_FLAG_BACKUP_SEMANTICScan mostly do what you need.我非常确定访问这些文件夹*的唯一方法是作为 Ring-0 运行，这是内核级用户的 CPU 自己的分区；这也是一些恶意软件/Rootkit 可以侵入您的系统的方式。
我非常有信心，这不是您可以在 .Net 中实现的目标，并且我不确定您是否可以在不编写系统级驱动程序（.sys 文件）的情况下真正实现它。
无论如何，文件系统适用于操作系统，如果您使用的是 NTFS 格式的驱动器并且内容已加密，则拥有超级读取所有驱动程序将不会为您解密文件。
编辑：这些文件夹是系统文件夹，如果您可以调用备份读/写功能，您可能会访问其他数据。
I'm pretty sure that the only way to get access to those folders* is to run as Ring-0 which is the CPU's own partition for a kernel level user; it's also the way that some Malware/Rootkits can get their hooks into your system.
I'm pretty confident that this is not something you can achieve in .Net, and I'm not sure you can actually achieve it at all without writing a system level driver (a .sys file).
Regardless, the Filesystem works for the OS, If you're on an NTFS formatted drive and the contents are encrypted, have a super read-all driver won't decrypt the file for you.
Edit: Those folders being the system folders, If you can PInvoke the BackupRead/Write functions, you might get access to the other data.
不，不存在可以访问所有内容的 root 用户。以系统或管理员或任何其他用户身份运行无法解决您的问题。您已经解决了一个非常复杂的问题，而用 C# 来完成它将是一个额外的挑战。我建议重新考虑 C# 的使用。
从此处开始并阅读以下说明FILE_FLAG_BACKUP_SEMANTICS 标志以及有关如何更改令牌权限的链接。基本上，您必须临时更改您无权读取的每个文件/目录的访问权限。
No, there is no root user who has access to everything. Running as SYSTEM or Administrator or any other user will not solve your problem. You've taken on a very complex problem, and accomplishing it in C# is going to be an added challenge. I recommend rethinking the use of C#.
Start here and read the description of the FILE_FLAG_BACKUP_SEMANTICS flag and the link there on how to change privileges on a token. Basically, you're going to have to temporarily change the access privileges on each file/directory you don't have read access to.
您可以以交互方式（以 SYSTEM 身份）运行应用程序（或命令提示符）。例如，请参阅 此内容的接受答案问题。一旦应用程序运行交互式上下文，它就可以直接打开系统卷信息。
[编辑以添加说明：]
在 Windows 中，是否有一个拥有一切的最终用户？
不。有一个特权 SeTakeOwnershipPrivilege，默认情况下授予管理员（隐式系统）以允许所有权要采取的对象。对象所有者始终可以更改 ACL 以授予自己访问权限。
还有另一个特权 SeBackupPrivilege，授予管理员和备份操作员（以及系统）。它的目的是允许读取文件来进行备份，并绕过正常的读取操作。这有效地允许对任何文件进行读取访问，绕过正常的访问控制限制。
如果是，该用户是谁？
不存在这样的用户。默认情况下，Windows 通过该目录上的 ACL 仅授予对 C:\System Volume Information 的系统访问权限。
如果是这样，我如何以该用户身份运行我的 C# 程序，以便可以看到所有文件？
您可以以 SYSTEM 身份运行该程序，专门查看系统卷信息（如上所述），尽管这不会'不一定让您查看所有文件。我认为拥有备份操作员权限并使用备份标志执行读取操作是查看所有文件（无论权限如何）的唯一机制。
You can run the application (or a command prompt) interactively (as SYSTEM). See, for instance, the accepted answer to this question. Once the application runs the interactive context, it can open System Volume Information directly.
[Edited to add clarification:]
In Windows, is there an ultimate user that owns EVERYTHING?
No. There is a privilege, SeTakeOwnershipPrivilege, that is by default granted to administrators (and implicitly System) that allows ownership of objects to be taken. The object owner can always change the ACL to give himself access.
There is another privilege, SeBackupPrivilege, granted to administrators and backup operators (and, again, System). It is intended to allow files to be read to conduct backups, and bypasses normal read operations. This effectively allows read access to any file, bypassing normal access control restrictions.
If so, who is that user?
There is not such a user. By default, Windows grants only SYSTEM access to C:\System Volume Information by an ACL on that directory.
If so, how do I run my C# program as that user so I can see all the files?
You can run the program as SYSTEM specifically to view System Volume Information (per above), although this won't let you view all the files necessarily. I think having Backup Operator privileges and conducting read operations with the backup flag is the only mechanism for seeing all files regardless of permissions.