Strange file names that are not actual existed in Windows

[mquan86]

I used latest Dua version (2.41.1) and scan the root C: drive, the result shows a lot of strange file names that are not actual existed in my drive.

I'm not sure if this is new issue in recent version or it always like that, at least in old ticket #302 I reported, I don't have these files.
Perhaps, another hint is I used to see similar issue when plug one of my NTFS Windows hard disks to Linux system, one beautiful day, Linux show a lot of files like that.

   2.86 MiB |    0.0%             |  XORXOR2869756188.doc                                                                                                                                                      ║
│ 390.62 KiB |    0.0%             |  ZZZZZ1196422543.sql                                                                                                                                                       ║
│ 341.80 KiB |    0.0%             |  XORXOR143084040.db                                                                                                                                                        ║
│ 341.80 KiB |    0.0%             |  CMJAhWcq3502958011.pst                                                                                                                                                    ║
│ 292.97 KiB |    0.0%             |  !!!!!1909590957.avi                                                                                                                                                       ║
│ 268.55 KiB |    0.0%             |  ZZZZZ1659910007.pdf                                                                                                                                                       ║
│ 244.14 KiB |    0.0%             |  CMJAhWcq147604571.pptx                                                                                                                                                    ║
│ 219.73 KiB |    0.0%             |  XORXOR3251707253.pps                                                                                                                                                      ║
│ 195.31 KiB |    0.0%             |  !!!!!2172911699.ppt                                                                                                                                                       ║
│ 170.90 KiB |    0.0%             |  ZZZZZ132868858.mdb                                                                                                                                                        ║
│ 146.48 KiB |    0.0%             |  CMJAhWcq3737853077.xlsx                                                                                                                                                   ║
│  97.66 KiB |    0.0%             |  XORXOR3110642927.xls                                                                                                                                                      ║
│  49.06 KiB |    0.0%             |  !!!!!3434969982.doc                                                                                                                                                       ║
│  29.30 KiB |    0.0%             |  !!!!!3526998886.eml                                                                                                                                                       ║
│  24.41 KiB |    0.0%             |  ZZZZZ2958862690.bmp                                                                                                                                                       ║
│  19.53 KiB |    0.0%             |  ZZZZZ1477579058.doc                                                                                                                                                       █
│  19.53 KiB |    0.0%             |  CMJAhWcq187612990.png                                                                                                                                                     █
│   9.77 KiB |    0.0%             |  XORXOR137285591.jpg        

OS: Windows 11
Format: NTFS
Version: 24.41.1

[Byron]

Looks like a hidden file that is not detected as hidden maybe?

This is probably not even a bug, but might need a feature to hide hidden or special files on Windows.

[mquan86]

I'm not sure, like you said, may be not a real bug but a feature.

At least I test that:

• Windows Explorer with full option to show hidden and system file, see nothing like that.
• Some other file manager with full option to show hidden and system file, see nothing
• Command dir /a to show all hidden and system file, see nothing.

I also test with old version 2.32.2 which I used in previous bug report (#302) and still see these files, so it means not version problem.

Btw, when testing the old version 2.32.2, I can say that the new version 24.41.1 is much faster not in only about the scan time but the usage as well when traveling through the folder. I would say excellent work team. Thank you so much.

[Byron]

Probably not hidden files, Copilot thinks it's related to decoy files.
Maybe something can be done to filter them out (as part of the Windows API call).

Luna Analysis

These are almost certainly hidden anti-ransomware “canary” / decoy files, not random NTFS corruption and not files invented by dua.

The giveaway is the pattern: fixed odd prefixes such as !!!!!, ZZZZZ, and XORXOR, random numeric suffixes, and bait extensions like .doc, .xlsx, .pdf, .pst, and .jpg. Those are exactly the sorts of files anti-ransomware products plant so they can detect unexpected mass modification/encryption. There is a prior Windows report of !!!!! and ZZZZZ files where the user identified Traps antivirus; the accepted explanation was third-party AV / anti-ransomware trap files. (learn.microsoft.com)

The XORXOR… part is an especially strong match: another Windows application reported hidden XORXOR* objects that appeared only when hidden files were enabled in its file browser, while Explorer did not show them. (sourceforge.net)

Why dua sees them: its Windows walker directly opens directory handles and enumerates entries with GetFileInformationByHandleEx(FileIdBothDirectoryInfo), rather than relying on the usual high-level directory listing path. That makes it plausible for it to expose entries that Explorer or dir suppresses—whether via hidden/system attributes or a security-product filesystem filter.

So I would characterize this issue as:

• Not likely a dua filename-parsing bug—the names look intentional, structured, and match known hidden decoy-file patterns.
• Likely a UX/filtering question: should dua omit FILE_ATTRIBUTE_HIDDEN and perhaps FILE_ATTRIBUTE_SYSTEM entries by default, or provide an explicit --include-hidden option?
• Worth confirming locally: inspect installed endpoint-security products, especially Palo Alto Networks Traps/Cortex XDR or similar anti-ransomware tooling. I would not delete or modify these files directly; let the security product manage them.

[mquan86]

Interesting, I have Cortex XDR on this instance (although I don't have any similar software in other Linux server that has these strange file names).

I'm not sure how to distinguish between these unreal files with normal hidden system file like user app data, windows system folder. As definitely we still want to show those usual hidden system files.
Seems like a complicated thing. I will leave that hard part for you 😜

(And yes, I understand your difficult that you don't have these file to test in your environment)