Windows NTFS feature that allows files to contain more than one stream of data. These streams can be used to hide malicious files behind a legitimate one.

learn more… | top users | synonyms

1
vote
1answer
21 views

Data Abstraction Layers in Forensic Imaging

I am a bit confused from various sources about the abstraction level and layers that a file resides in forensic imaging. I have found two slightly different explanations: The first one includes a) ...
3
votes
2answers
751 views

How can I identify / discover files hidden with ADS?

ADS, or alternate data streams, were added in to Windows in 1993 (First Windows NT version) as a feature of the new NTFS file system to help support some features of the Mac OS at the time. I like to ...