windows - NTFS Extended Attributes,

Question

I have been struggling to understand how exactly NTFS Extended file Attributes works. I'm studying the Data Loss Prevention(DLP) products (like Symantec, McAfee, Forcepoint DLP products). and in the DLP products, there has a mechanism that the DLP can insert a Classification ID into the file to classify the file so that even the file is sent out to another PC, the DLP still can track the file if the target PC installs DLP software as well. I want to know-how is the Classification ID embedded into the file, googled this a lot but still unsure of this.

Thanks in advance.

Answer 1

数据分类软件不使用扩展属性进行分类。备用数据流用于某些文件格式。对于 MS Office 文件，可以根据文件版本使用OpenXml和DsoFile 。这里的分类 ID 是数据流本身的一部分。