Forensic Riddle #9c – Answer

The answer may surprise you (or not). It’s just a matter of adding extra blank character at the end of the second ‘Riddle’ directory i.e. these are ‘Riddle’ and ‘Riddle ‘ directories respectively. Obviously, not very visible on the UI.

As usual, one needs to bypass CreateDirectoryA/W and use native APIs directly (otherwise extra blank characters/spaces/ will be trimmed before the buffer is passed to native APIs and the call will fail).

 

Forensic Riddle #9b – Answer

NTFS file system is by design case-sensitive, yet this option is disabled by default.

One needs to change the following option in Registry:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel]
"obcaseinsensitive"=dword:00000001

and restart the system to be able to create files and directories that are case-sensitive.

Notably, Windows APIs e.g. CreateDirectoryA/W are mapped to NtCreateFile API with OBJ_CASE_INSENSITIVE flag on, so they can’t be used to create case-sensitive files/directories.