Post by SteveGG
Well, that about covers it.
Just a kind of phantom duplicate listing of all the folder structure.
Still no good ideas ? Anyone ?
As I've said before, it's no big deal, but I don't like mysteries.
Two action items for you:
1) Are you using any unusual software.
DropBox ? Do an inventory. Check your Programs and Features.
Think about any ShellEx you've added, any little "tweakers"
you're using, and so on.
2) At one time, I thought you were the guy that was
going to take all the executables on a x64 system,
and put them into just one folder set. Am I mistaken ?
Was it you or someone else who was working on that ?
Since the flaw isn't one involving the various "sections"
in a File Explorer display, it's my feeling there may be
some sort of evidence in the file system itself. In
which case, I use Everything.exe to make a CSV file listing.
Or use NFI.exe and look for funny stuff in there. I would
look for items with "Program" in the file name text string,
to eliminate most of the entries and then you can focus on things
that look like that.
At least on Win10, you can do this. I don't know if the
"fsutil" on Win7 also has this feature or not.
In an Administrator Command Prompt
fsutil usn readjournal c: > out2.txt
The NTFS file system, records file system changes. They're
recorded in a metadata file, the USN. That command keeps
track. On some systems here, the USN becomes as big as
10GB. It can remember a *lot* of stuff.
It would be the same deal. You'd be looking for entries
concerning "Program Files".
I consider that a long shot, so that wouldn't be my first
choice of a forensic technique. But if you run out of
other little projects to do, you can give that a try
and see how many times you've messed with the "Program Files"
I suspect there is an illegal file name in your file system,
and the system reads it, truncates the illegal part, and
carries on. Leading to two items displayed on the screen.
But unless you use the utilities to track it down, you're
never going to find it.