Windows 8’s Fast Startup feature may put files stored on a Windows partition at risk

Jan 11, 2013 15:46 GMT  ·  By

Fast Startup is one of the new features integrated into Microsoft’s Windows 8 operating system that basically allows Windows to boost faster on a dual-boot configuration.

The problem is that the tool puts locally stored data at risk when the user loads the second operating system, in most cases a Linux distribution.

The explanation is as simple as it could be. In dual-boot configurations, the Fast Startup option doesn’t shut down Windows 8 completely, but only forces it to enter a hibernation mode that allows it to reboot a bit quicker when the users sign out from the other operating system.

Since this is nothing more than a hibernation state, Windows 8 will continue to store Windows session information, including file system data belonging to FAT and NTFS partitions.

Even though these system files are actually “locked” in a memory image automatically restored when the user boots back in Windows 8 with Fast Startup, specific files could be easily removed. And here’s why.

The developers behind the ntfs-3g FUSE filesystem driver have discovered that Linux distributions may attempt to write data on Windows partitions as well, sometimes overwriting the system file stored in the memory image we were talking about. When booting back into Windows 8, Fast Startup loads the operating system, but without the missing data.

In order to overcome this problem, the software creators have introduced an update that would require any Linux distribution to mount NTFS partitions as read-only and thus block any attempt to overwrite system data locked by Fast Startup.

According to H Online, however, an official release of the ntfs-3g driver with these modifications is yet to be launched, so Windows 8 – Linux dual-boot configurations are still vulnerable to this issue.

In addition, most Linux distributions on the market, including Ubuntu, Debian and OpenSuSE are yet to address this problem, so blocking the operating system from overwriting Fast Startup data is impossible for the time being.