Questions tagged [alternative-data-streams]
Windows NTFS feature that allows files to contain more than one stream of data. These streams can be used to hide malicious files behind a legitimate one.
6 questions
0
votes
0
answers
43
views
Why is running an exe created from ADS, failing in Win-11 with incompatibility of 64-bit OS?
I'm experimenting with ADS (Alternative Data Streams), and tried to create a text file with the calc.exe embedded in an ADS.
I used the following steps to do this:
"Hello" >t2.txt
Get-...
- 275
1
vote
2
answers
2k
views
How to copy files without copying Alternate Data Streams
I want to backup my infected Windows system's files before formatting it all and reinstalling the system. I would do it from a Linux Live USB. I've heard that one should be careful in copying only the ...
- 179
1
vote
0
answers
570
views
Is is possible to modify the Alternate Data Stream (ADS) in MS Word with Protected View?
Is it possible to modify the Alternate Data Stream (ADS) to prevent .docx to be opened in Protected View for files downloaded from Internet.
When is Protected View used?
Since Protected View ...
- 1,588
6
votes
2
answers
605
views
Data Abstraction Layers in Forensic Imaging
I am a bit confused from various sources about the abstraction level and layers that a file resides in forensic imaging.
I have found two slightly different explanations:
The first one includes
a) ...
- 235
11
votes
2
answers
38k
views
How can I identify / discover files hidden with ADS?
ADS, or alternate data streams, were added in to Windows in 1993 (First Windows NT version) as a feature of the new NTFS file system to help support some features of the Mac OS at the time. I like to ...
- 1,753
4
votes
1
answer
2k
views
Does anti-virus/security software protect against NTFS ADS?
I know that NTFS has features called ADS which may be used to hide malware. So does antivirus/security software, such as Norton 360, protect against this type of attack?
- 43