Bypassing Screenshares with Whiteout (Method 3: NTFS Mount Point with USB)

Bypassing Screenshares with Whiteout (Method 3: NTFS Mount Point with USB)

While being the most complicated screenshare preparation methods we offer a guide on, this method is definitely one of the coolest. This method uses a lesser-known feature of NTFS, called mount points. This tutorial will walk you through how to do it using the Windows graphical interface. This method is also possible to execute by using CMD and typing commands. This generates less traces that may indicate you are using this method, and as such I recommend you use commands. You can find information on the commands you'd execute to do that here.
Step 1: Get a USB This method requires a USB formatted as FAT32. Check our USB screenshare guide method for more info on how to format a USB drive.
Step 2: Download Whiteout Put Whiteout on the USB drive, and name it the name of a legitimate executable. For this tutorial, I will be naming it "AnyDesk.exe".
Step 3: Create an Empty Folder You now need an empty folder that will contain the real executable. For this tutorial, I made an empty folder called "Programs" in my Documents folder on my C:\ drive. I suggest you be more creative than me.
Step 4: Mount the USB Launch the Disk Management Windows utility, and find your USB in the list:
Right click the part with the stripes, and press "Change drive letter and paths". If your drive has a disk letter, select it and press "Remove". It is important that your USB not have a disk letter assigned. If you had to remove a disk letter from your USB, you will need to reboot your machine.
If this menu looks like the above, you are set to continue. Press "Add...". You will see this menu:
Select "Mount in the following empty NTFS folder", the press "Browse" and navigate to the empty folder you made in step 3. Once selected, press "OK".
Step 5: Launch Whiteout Navigate to the empty folder you made in step 3, and you will see that AnyDesk (Whiteout) is now in the folder! **Ensure Minecraft is not open**, and launch Whiteout. Once Whiteout says "Waiting for Minecraft", proceed to the next step.
Step 6: Remove the NTFS Mount Go back to the Disk Management tool, and get to the same screen as in step 4. Select the path that the USB is mounted at, and press "Remove":
A prompt will ask if you'd like to remove this drive path, press "Yes". You may now unplug the USB
Step 7: Unplug the USB Remove the USB from your system.
Step 8: Put Real Executable into Path Whiteout is now successfully running. Stopping here and skipping to step 10 will bypass several automated tools, however in a manual screenshare, it is necessary to put a real executable with the same name as Whiteout into the empty folder you created in step 3. Navigate to the folder, and you will see it is empty. For this guide, I named Whiteout "AnyDesk.exe", and as such I put the real AnyDesk executable into the folder.
Step 9: Clear USN Journal This step is optional, but highly recommended. It is also best if you only do this if you've recently restarted your system, to avoid suspicion on why your USN journal is so small. To do this, open a CMD and run the following command: FSUTIL USN DELETEJOURNAL /D C: This clears traces of files being moved around.
Step 10: Launch Minecraft It is best if you wait a span of time before opening Minecraft after Whiteout is set up and running. This allows the USN journal to grow a bit, among other things. While not required, it is recommended.