A message from our CEO about the future of Stack Overflow and Stack Exchange. Read now.

Questions tagged [alternative-data-streams]

Windows NTFS feature that allows files to contain more than one stream of data. These streams can be used to hide malicious files behind a legitimate one.

Filter by
Sorted by
Tagged with
1
vote
2answers
661 views

How to copy files without copying Alternate Data Streams

I want to backup my infected Windows system's files before formatting it all and reinstalling the system. I would do it from a Linux Live USB. I've heard that one should be careful in copying only the ...
6
votes
2answers
420 views

Data Abstraction Layers in Forensic Imaging

I am a bit confused from various sources about the abstraction level and layers that a file resides in forensic imaging. I have found two slightly different explanations: The first one includes a) ...
7
votes
2answers
19k views

How can I identify / discover files hidden with ADS?

ADS, or alternate data streams, were added in to Windows in 1993 (First Windows NT version) as a feature of the new NTFS file system to help support some features of the Mac OS at the time. I like to ...