Solved

Cookie File Slack

Posted on 2010-08-19
9
1,752 Views
Last Modified: 2016-02-21
I'm looking over a case that just came in and I was examining the cookies because the client wanted them looked over.  I noticed that 3 of the files have file slack.  Is this because a bigger file was there and when the current cookie was written to that sector, it was smaller than the previous one?  Also, all the cookies begin in various sector offset's except for one; which begins in sector offst 0.  Any ideas?  I've asked around in my shop and they have no clue, we've googled all day and found nothing.
0
Comment
Question by:AlwaysDeployed
  • 3
  • 3
  • 2
  • +1
9 Comments
 
LVL 83

Accepted Solution

by:
Dave Baldwin earned 250 total points
ID: 33481819
I would expect the slack.  'Session' cookies which are stored only as long as the browser is open should be erased the next time the browser is opened.  There is an index file there somewhere which contains pointers to the cookies.  No particular need to take up the slack every time.
0
 
LVL 16

Assisted Solution

by:LeeKowalkowski
LeeKowalkowski earned 250 total points
ID: 33483146
Doesn't every small file have slack?  Cookies are typically small.  

Internet Explorer doesn't write session cookies to the file system.  They must be persistent cookies.

What specifically about your findings do you consider to be atypical?  What's the OS and File System too?
0
 

Author Comment

by:AlwaysDeployed
ID: 33498396
Out of about 50 cookies 2 of them have file slack and the physical sizes aren't equal to the logical size.  The OS is Win XP NTFS.  I understand that most files have file slack depending on the size of the file but why would only two of the cookies have slack and the rest don't.
0
 
LVL 16

Expert Comment

by:LeeKowalkowski
ID: 33499244
Indeed, it's the ones that don't that I'd be more interested in.  What's the physical size? 1KB?  All but two cookies are also logically exactly 1KB?  That doesn't seem likely.
0
Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

 

Author Comment

by:AlwaysDeployed
ID: 33539083
The physical size of one is 50kb and the other is 4,096kb.  The rest of the cookies on the drive are the same physical and logical size except for these two.  
0
 
LVL 83

Expert Comment

by:Dave Baldwin
ID: 33539444
When I look at Properties for cookies, the sizes vary from 61 bytes to 2.86 Kbytes.  Windows Explorer lists all the small ones as 1K.  50kb is kinda large for a cookie.  I had some at 4k or 5k but I deleted them.
0
 

Author Closing Comment

by:AlwaysDeployed
ID: 33555862
My issue wasn't answered directly but the answers received did give me other ideas and reference points.  I appreciate the help.
0
 

Expert Comment

by:brian oldeard
ID: 41474836
I have the same problem with cookies... I can't explain that some of the cookies have slack and the rest don't? And cookies begin in various sector offset? I have windows 7 with NTFS.   Can somebody explain me clearly...

Thank for your help guys,
0
 
LVL 83

Expert Comment

by:Dave Baldwin
ID: 41474950
Lady Amherst, this is an old question.  The only reason I know that you posted is because I answered it 5 years ago.  Please open a new question so that other people will see it and respond.
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Introduction If you're like most people, you have occasionally made a typographical error when you're entering information into an online form.  And to your consternation, the browser remembers the error, and offers to autocomplete your future entr…
Citrix XenApp, Internet Explorer 11 set to Enterprise Mode and using central hosted sites.xml file.
Google currently has a new report that is in beta and coming soon to Webmaster Tool accounts. This Micro Tutorial will highlight new features for Google Webmaster Tools.
How to create a custom search shortcut to site-search Experts Exchange using Google in the Firefox browser. This eliminates the need to type out site:experts-exchange.com whenever you want to search the site. Launch your Bookmark Menu: Press 'Ctrl +…

920 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now