Think you have some ADS in your NTFS? You do, Alternate Data Streams (ADS). Here's some ADS information you might not have seen before...
"While ADS is not widely supported/used by many apps (maybe with the exception of malware ), it can be still used for some interesting purposes. In this short article, I describe a few legitimate uses of ADS by Windows that I know of.
If you know some others or if you spot any mistake, please let me know. Thanks.
This post is loosely based on the Microsoft list, but it contains some more details and looks at these streams from a ‘forensic angle’.
Related Past Post XRef:
ADSdotNET – Access NTFS Alternate Data Streams from your managed languages without P/Invoke
Accessing NTFS Alternate Data Streams with C#
HijackThis gets all open. Download the VB6 (yes, VB6) code now...