you are viewing a single comment's thread
view the rest of the comments
[–] 31 points 1 year ago* (4 children)

Alternate data streams look like normal files but with an appended identifier.

For example test.txt:stream1 is an alternate data stream of test.txt. Move or copy the file and the ADS goes with it.

They can be created like other files (“echo > test.txt:stream1”)

You can see them with “dir /r” at the command line.

You can even have an alternate data stream with no corresponding file. In my opinion this is what thumbs.db should have been.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 15 points 1 year ago (3 children)

    you are shitting me, that's so cool. This command only works for NTFS?

  • source
  • parent
  • hideshow 3 child comments
  • [–] 12 points 1 year ago* (last edited 1 year ago) (1 child)

    It works, and yes only on NTFS… but many applications may not be able to open these “files”.

    It’s actually sort of a weird historical thing, goes back to the roots of Windows NT in VMS and also compatibility with Mac OS (classic) and its “resource forks”

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 1 year ago

    Back 20+ years ago I used alternate data streams to his my collection of files (the ones you find online as a teenager) behind a text file. You can shove anything you want (I think) in them, even including extensions to make sure it opened in the right program (i.e. test.txt:malware.msi).

  • source
  • parent