What Are I7CIPB~N Files ?

[HDX-NAS]

Hi all.

I am seeing these files everywhere on our NAS when mounted through smb. .
But they are not present when using Filestation .

[dolbyman]

never seen them ..maybe temp files from 7z malware encryption process?

nas web exposed?

[HDX-NAS]

never seen them ..maybe temp files from 7z malware encryption process?

nas web exposed?

NAS not exposed to tinternet.
Malware scans happen every day.

[dolbyman]

what is the size of these files?

[HDX-NAS]

1.3mb

Maybe they are creted by either Neofinder of Carbon Copy Cloner.
Both of which we use.

BTW, we use Macs, so am mounting smb on Macs.

[dolbyman]

try to open them in a large text editor..see of any header info is in there

[HDX-NAS]

So I just found this:
http://goodfuturenow.blogspot.com/2018/ ... erver.html

[Mousetick]

A search on the web turns up a few hits but no real answer. A name like I7CIPB~N is the result of Samba's name mangling process for filenames that are invalid and cannot be displayed in the DOS (!!!) 8.3 format. This behavior is configurable and is AFAIK not normally enabled in QNAP's Samba configuration.

See https://www.samba.org/samba/docs/curren ... onf.5.html, scroll down to "mangled names (S)", for more details.

Are you connecting exclusively via SMB or both via SMB and AFP (netatalk)?
Are you using very old firmware on the NAS(es) or very old macOS on the clients?

Anyhow, I doubt it's Carbon Copy Cloner. It could be NeoFinder. Or it could very well be a server-side issue. Try to reproduce and isolate the scenario that creates these files and report it to the developer.

[Mousetick]

So I just found this:
http://goodfuturenow.blogspot.com/2018/ ... erver.html

Did you really mean to link to this article or was this a keyboard slipup? I don't see how that article relates to your issue at all.

Unless you're fed up with the I7CIPB~N c.rap and are considering building your own Linux-based file server

[HDX-NAS]

Open the link & search for
I7CIPB~N

I think this is the answer as we use icons for HDDs that have been ingested into the NAS's .

[Mousetick]

Open the link & search for
I7CIPB~N

I think this is the answer as we use icons for HDDs that have been ingested into the NAS's .

Ha ha! I totally missed that - but to be fair, it was buried deep in a very long post

Yeah that's it, good find. Custom folder icons have the filename Icon^M which becomes mangled into I<hash>~N. Now the question is, why are you seeing these files on macOS clients? They should be hidden. Something is not working quite right.

[HDX-NAS]

Open the link & search for
I7CIPB~N

I think this is the answer as we use icons for HDDs that have been ingested into the NAS's .

Ha ha! I totally missed that - but to be fair, it was buried deep in a very long post

Yeah that's it, good find. Custom folder icons have the filename Icon^M which becomes mangled into I<hash>~N. Now the question is, why are you seeing these files on macOS clients? They should be hidden. Something is not working quite right.

I don't see them with afp, only smb. .
I have always used afp, BUT, we are moving to our new 7,1 Rack Mac Pro's which we ordered BEFORE Big Sur. . They are running Catalina 10.15.7. . I read that Apple haven't updated afp for donkeys & are aiming to leave it where it is. Which I am told will be a potential security issue moving forward. . so, I have started using smb. . . But of course it isn't as straight forward as that:
viewtopic.php?t=152856#p747938

We have 2 studios. One of which is having issues with random un-mounts. Here at my studio our NAS has been working well on smb. Ran it all day yesterday looping a 196 track session, then recording into that session. All fine. Today I have mounted our other studio's NAS here all day doing the same. . No un-mounts. . So there must be something different in the connection chain in the other studio as both 7,1 RMPs are identical . .

Anyway . . Thank you for your input

[Mousetick]

I read that Apple haven't updated afp for donkeys & are aiming to leave it where it is. Which I am told will be a potential security issue moving forward. .

Yes, it's deprecated and unmaintained, and has been for quite a while (since Mac OS X 10.9). Server-side is no longer provided and client-side is still supported but not for long. SMB is now the native file-sharing protocol for macOS. I believe it's not so much a security risk as a feature-drop risk. You know Apple is not afraid of dropping features and support for older software/hardware whenever it feels like it and leaving behind users who didn't go with the flow.

I don't think security would be much of a concern, unless you use AFP with unencrypted connections over a public network which is a security issue yesterday, today and tomorrow, regardless of deprecation/support status.

Are the SMB unmounts/disconnects occurring at particular points in time or randomly? During transfers or while idle?