Monday, March 26, 2012

Think you have some ADS in your NTFS? You do, Alternate Data Streams (ADS). Here's some ADS information you might not have seen before...

Hexacorn Ltd - Good Alternate Data Streams (ADS)

"While ADS is not widely supported/used by many apps (maybe with the exception of malware :) ), it can be still used for some interesting purposes. In this short article, I describe a few legitimate uses of ADS by Windows that I know of.

If you know some others or if you spot any mistake, please let me know. Thanks.

This post is loosely based on the Microsoft list, but it contains some more details and looks at these streams from a ‘forensic angle’.

SNAGHTML38699d9e

image..."

 

Related Past Post XRef:
ADSdotNET – Access NTFS Alternate Data Streams from your managed languages without P/Invoke
Accessing NTFS Alternate Data Streams with C#
HijackThis gets all open. Download the VB6 (yes, VB6) code now...

Posted

2 comments:

  1. Stephen ClearyMon Mar 26, 07:54:00 PM PDT

    I'm not sure if you've heard this, but the Windows 8 "ReFS" does not support named streams: http://blogs.msdn.com/b/b8/archive/2012/01/16/building-the-next-generation-file-system-for-windows-refs.aspx

    ReplyDelete
  2. GregMon Mar 26, 08:15:00 PM PDT

    Yep, sure did...

    But ReFS is for Windows 8 Server. It's not part of Windows 8 Client at this point and it's going to be a while before it makes that jump (heck in ReFS v1 you can't even boot off it).

    But great point, ADS's days might be numbered (assuming ReFS takes off, that ADS isn't added back, yada, yada...)

    ReplyDelete

NOTE: Anonymous Commenting has been turned off for a while... The comment spammers are just killing me...

ALL comments are moderated. I will review every comment before it will appear on the blog.

Your comment WILL NOT APPEAR UNTIL I approve it. This may take some hours...

I reserve, and will use, the right to not approve ANY comment for ANY reason. I will not usually, but if it's off topic, spam (or even close to spam-like), inflammatory, mean, etc, etc, well... then...

Please see my comment policy for more information if you are interested.

Thanks,
Greg

PS. I am proactively moderating comments. Your comment WILL NOT APPEAR UNTIL I approve it. This may take some hours...