Hi guys,
I want get the ACL info from a Linux Mounted NTFS volume, and restore it on a windows.
I execute secaudit -v file name on both the Linux System and Windows System for same file
and compared the secaudit tool's output, found the hex dump alwasy has only one character different, e.g. the Linux hex dump start at : 000000 0100048c
but on windows, it start at : 000000 01000484, that's only the different, the rest of the part are the same.

why the hex content different? will it affect my restore result?

Hi,


No idea. Please post the full outputs on Windows and Linux, including the commands you used, the file or directory name, the computed hash, etc. Better first get the data from Windows.

*edit* Could be a new behavior from a background auditing in a recent Windows version. What is the Windows version used ? Please also post the ACL of the parent directory.

Regards

Jean-Pierre