01. Alternate Data Streams (ADS)

Overview¶

Alternate Data Streams (ADS) is a feature of the NTFS (New Technology File System) that allows additional data to be associated with a file.

ADS was designed to provide compatibility with the resource fork concept used by the macOS HFS file system. On Windows, a file can contain multiple data streams without changing its visible filename.

An ADS is accessed using the following syntax:

filename:streamname

Example:

document.txt:secret.txt

Here:

document.txt is the primary file.
secret.txt is the name of the alternate data stream.

How ADS Works¶

A file on an NTFS volume can contain multiple data streams.

Default Data Stream¶

The default stream contains the main contents of the file. It is accessed normally using the filename.

document.txt

Alternate Data Stream¶

An alternate stream stores additional data associated with the primary file.

document.txt:secret.txt

The alternate stream is not normally displayed as a separate file in Windows Explorer.

File Structure¶

document.txt
│
├── Default data stream
│   └── Main file contents
│
└── Alternate data stream
    └── Additional data

The primary file and its alternate streams are associated with the same underlying NTFS file record.

Working with ADS Using Windows CMD¶

Windows Command Prompt can be used to create, read, inspect, and remove alternate data streams.

Create a Test Directory and File¶

Open Command Prompt and run:

mkdir C:\ADSLab
cd C:\ADSLab

echo Main file content > report.txt

This creates report.txt with the following content:

Main file content

Create an Alternate Data Stream¶

echo This is alternate stream data > report.txt:notes.txt

This creates an alternate stream named notes.txt attached to report.txt.

The main file and the alternate stream contain separate data.

Read the Default Data Stream¶

Using type:

type report.txt

Expected output:

Main file content

Read the Alternate Data Stream¶

Using type:

type report.txt:notes.txt

Using more:

more < report.txt:notes.txt

Expected output:

This is alternate stream data

List Alternate Data Streams¶

The dir /r command can display alternate data streams associated with files in the current directory.

dir /r

Example output:

 Directory of C:\ADSLab

report.txt
             28 report.txt:notes.txt:$DATA

The :$DATA suffix identifies a data stream. The exact output may vary depending on the Windows version and file contents.

Open an Alternate Stream in Notepad¶

To open the default stream:

notepad report.txt

To open the alternate stream:

notepad report.txt:notes.txt

This allows the stream data to be viewed or edited in Notepad. Application behavior may vary depending on permissions and whether the stream already exists.

Check File Information¶

To display the ordinary file listing:

dir report.txt

To display alternate stream information:

dir /r

A standard directory listing may not clearly show the size of every alternate stream.

Remove an Alternate Data Stream¶

To delete the test stream:

del report.txt:notes.txt

Verify the remaining streams:

dir /r

The default file report.txt should remain intact.

Complete Windows CMD Demonstration¶

The following example demonstrates the creation, reading, and inspection of an alternate data stream.

mkdir C:\ADSLab
cd C:\ADSLab

echo Main file content > report.txt
echo Additional stream data > report.txt:notes.txt

echo.
echo [Default Stream]
type report.txt

echo.
echo [Alternate Stream]
type report.txt:notes.txt

echo.
echo [Stream Information]
dir /r

The demonstration shows that:

report.txt contains the main file content.
report.txt:notes.txt contains additional stream data.
Both streams belong to the same NTFS file.
The alternate stream is not displayed as a normal separate file.

Working with ADS Using PowerShell¶

PowerShell provides commands for inspecting and managing alternate data streams.

List All Streams of a File¶

Get-Item -Path .\report.txt -Stream *

Example output:

FileName     Stream       Length
--------     ------       ------
report.txt   :$DATA       18
report.txt   notes.txt    24

The :$DATA stream represents the default data stream.

Enumerate Streams in a Directory¶

Get-ChildItem -Path C:\ADSLab -File -Recurse |
    ForEach-Object {
        Get-Item -LiteralPath $_.FullName -Stream *
    }

This can help identify streams associated with files in the selected directory.

Remove an Alternate Data Stream¶

To remove the notes.txt stream:

Remove-Item -LiteralPath .\report.txt -Stream notes.txt

Verify the remaining streams:

Get-Item -Path .\report.txt -Stream *

The default stream remains intact while the selected alternate stream is removed.

Viewing ADS in Windows Explorer¶

Windows Explorer generally does not display alternate data streams as separate files.

For example, the following stream:

report.txt:notes.txt

may not appear as an independent file in the directory.

Command-line tools such as dir /r and PowerShell stream enumeration can be used to inspect the file's streams.

ADS and File Size¶

Alternate streams can contain additional data without necessarily being reflected in the ordinary file size displayed by basic directory listings.

For example:

report.txt

The primary file may appear small even when it has additional data stored in an alternate stream.

To inspect the streams and their sizes, use:

dir /r

or PowerShell:

Get-Item -Path .\report.txt -Stream *

Security Implications¶

ADS is a legitimate NTFS feature, but it can also be abused by attackers.

Hiding Unwanted Data¶

Attackers may attempt to store scripts, executable content, or other unwanted data in alternate streams associated with legitimate files.

This can make the data less visible during basic file browsing.

Evading Basic Detection¶

Some older or poorly configured security tools may inspect only the default data stream. As a result, content stored in an alternate stream might be overlooked.

Modern security products may inspect ADS, so ADS should not be considered a reliable method of bypassing antivirus or endpoint security.

Storing Additional Information¶

ADS can also be used for legitimate purposes, such as storing metadata, notes, or other information associated with a file.

Detecting Alternate Data Streams¶

System administrators and security analysts can inspect NTFS files for unexpected alternate streams.

Using Windows CMD¶

dir /r

This displays alternate stream information for files in the current directory.

Using PowerShell¶

Get-ChildItem -Path C:\ADSLab -File -Recurse |
    ForEach-Object {
        Get-Item -LiteralPath $_.FullName -Stream *
    }

Security Monitoring Practices¶

Enumerate alternate streams on NTFS volumes.
Investigate unexpected streams attached to system or user files.
Monitor suspicious file creation and access activity.
Scan stream contents with security tools where supported.
Review unusual executable or script activity associated with files containing ADS.

Important Limitations¶

ADS is supported by NTFS, not by every file system.
Copying files to file systems that do not support ADS may cause alternate streams to be lost.
Some file-transfer tools preserve ADS, while others do not.
Alternate streams are not the same as hidden files or hidden directories.
File permissions still apply to alternate streams.
ADS should not be treated as a secure method of storing sensitive information.

Conclusion¶

Alternate Data Streams is an NTFS feature that allows multiple data streams to be associated with a single file. The default stream stores the primary file contents, while alternate streams store additional information.

Windows CMD and PowerShell provide useful methods for creating, reading, enumerating, and removing ADS. Although ADS has legitimate uses, attackers may abuse it to conceal unwanted data or evade basic file inspection.

Understanding ADS helps security professionals investigate suspicious files, identify hidden streams, and improve Windows endpoint monitoring.