Skip to main content

Questions tagged [alternative-data-streams]

Windows NTFS feature that allows files to contain more than one stream of data. These streams can be used to hide malicious files behind a legitimate one.

Filter by
Sorted by
Tagged with
0 votes
0 answers

Why is running an exe created from ADS, failing in Win-11 with incompatibility of 64-bit OS?

I'm experimenting with ADS (Alternative Data Streams), and tried to create a text file with the calc.exe embedded in an ADS. I used the following steps to do this: "Hello" >t2.txt Get-...
not2qubit's user avatar
  • 275
1 vote
2 answers

How to copy files without copying Alternate Data Streams

I want to backup my infected Windows system's files before formatting it all and reinstalling the system. I would do it from a Linux Live USB. I've heard that one should be careful in copying only the ...
Eärendil Baggins's user avatar
1 vote
0 answers

Is is possible to modify the Alternate Data Stream (ADS) in MS Word with Protected View?

Is it possible to modify the Alternate Data Stream (ADS) to prevent .docx to be opened in Protected View for files downloaded from Internet. When is Protected View used? Since Protected View ...
cyzczy's user avatar
  • 1,588
6 votes
2 answers

Data Abstraction Layers in Forensic Imaging

I am a bit confused from various sources about the abstraction level and layers that a file resides in forensic imaging. I have found two slightly different explanations: The first one includes a) ...
user3127632's user avatar
11 votes
2 answers

How can I identify / discover files hidden with ADS?

ADS, or alternate data streams, were added in to Windows in 1993 (First Windows NT version) as a feature of the new NTFS file system to help support some features of the Mac OS at the time. I like to ...
cutrightjm's user avatar
  • 1,753
4 votes
1 answer

Does anti-virus/security software protect against NTFS ADS?

I know that NTFS has features called ADS which may be used to hide malware. So does antivirus/security software, such as Norton 360, protect against this type of attack?
Secram Sjsop's user avatar