Questions tagged [alternative-data-streams]
Windows NTFS feature that allows files to contain more than one stream of data. These streams can be used to hide malicious files behind a legitimate one.
5
questions
1
vote
2
answers
2k
views
How to copy files without copying Alternate Data Streams
I want to backup my infected Windows system's files before formatting it all and reinstalling the system. I would do it from a Linux Live USB. I've heard that one should be careful in copying only the ...
- 179
1
vote
0
answers
523
views
Is is possible to modify the Alternate Data Stream (ADS) in MS Word with Protected View?
Is it possible to modify the Alternate Data Stream (ADS) to prevent .docx to be opened in Protected View for files downloaded from Internet.
When is Protected View used?
Since Protected View ...
- 1,558
6
votes
2
answers
547
views
Data Abstraction Layers in Forensic Imaging
I am a bit confused from various sources about the abstraction level and layers that a file resides in forensic imaging.
I have found two slightly different explanations:
The first one includes
a) ...
- 235
11
votes
2
answers
37k
views
How can I identify / discover files hidden with ADS?
ADS, or alternate data streams, were added in to Windows in 1993 (First Windows NT version) as a feature of the new NTFS file system to help support some features of the Mac OS at the time. I like to ...
- 1,744
4
votes
1
answer
2k
views
Does anti-virus/security software protect against NTFS ADS?
I know that NTFS has features called ADS which may be used to hide malware. So does antivirus/security software, such as Norton 360, protect against this type of attack?
- 43