Tweet
NTFS Alternate Data Streams (ADS, first introduced in WinNT 3.1, and available on WinNT4 and Win2K) is a little known and mostly undocumented NTFS feature that provides a means of modifying file data without actually changing the original image of the file - that is, you can save multiple images of the one file, using just the one filename. In effect it is almost like hiding multiple files behind one parent file.
The following demo creates three files, although only one is actually visible (even using command prompt "dir" listing). The first file created is the actual parent file, called "stream.txt" in this demo. This is the visible file. The two other files that get created with it are ADS files, and as such they are - for all intensive purposes - completely invisible, even though they hold unique data. Even anti-virus scanners don't (yet) scan in this area (although ones that scan files on disk-writes should detect them).
How do you create an ADS stream file? Easy - just open it with ":StreamIdentifier" appended to the end of the parent filename (where "StreamIdentifier" can be any unique alphanumeric string). If you open an ADS file that doesn't have a parent, the parent will be created as a 0-byte file.
Please don't abuse this. It is a fantastic feature to use for protecting your own programs and data files - for example, it makes it very hard for a trojan to corrupt your program files if the files are ADS files, as unless it knows the specific parent filename _AND_ StreamIdentifier the trojan won't be able to find your files. Also, it's kind of cute to look in your program directory and only see the exe and no other files! Another great use of ADS files is multiple backups! You could even write your own file-protection system such as the one used by Win2K - if a file is changed, you just go back to a previous ADS stream and restore that image. It's just too good to abuse!
(but also too easy 
)
Enjoy!
[This message has been edited by Wayne Diamond (edited April 16, 2001).]
The following demo creates three files, although only one is actually visible (even using command prompt "dir" listing). The first file created is the actual parent file, called "stream.txt" in this demo. This is the visible file. The two other files that get created with it are ADS files, and as such they are - for all intensive purposes - completely invisible, even though they hold unique data. Even anti-virus scanners don't (yet) scan in this area (although ones that scan files on disk-writes should detect them).
How do you create an ADS stream file? Easy - just open it with ":StreamIdentifier" appended to the end of the parent filename (where "StreamIdentifier" can be any unique alphanumeric string). If you open an ADS file that doesn't have a parent, the parent will be created as a 0-byte file.
Please don't abuse this. It is a fantastic feature to use for protecting your own programs and data files - for example, it makes it very hard for a trojan to corrupt your program files if the files are ADS files, as unless it knows the specific parent filename _AND_ StreamIdentifier the trojan won't be able to find your files. Also, it's kind of cute to look in your program directory and only see the exe and no other files! Another great use of ADS files is multiple backups! You could even write your own file-protection system such as the one used by Win2K - if a file is changed, you just go back to a previous ADS stream and restore that image. It's just too good to abuse!
(but also too easy )Enjoy!
Code:
'[b]ADS_STREAMS.BAS[/b] - NTFS Alternate Data Streams demo, by Wayne Diamond
'Requires NT3.51, NT4, Win2K or higher.
#COMPILE EXE "streams.exe"
$STREAMDIR = "C:\Streams"
FUNCTION PBMAIN() AS LONG
ON ERROR RESUME NEXT
DIM TempStr AS STRING * 6
'// Create and change directory to $STREAMDIR
MKDIR $STREAMDIR
CHDRIVE LEFT$($STREAMDIR,1)
CHDIR "\"
CHDIR RIGHT$($STREAMDIR, LEN($STREAMDIR) - 2)
'// Create the PARENT file
TempStr = "Parent"
OPEN $STREAMDIR & "\stream.txt" FOR BINARY ACCESS WRITE LOCK SHARED AS #1
PUT #1, 1, TempStr
CLOSE #1
'// Create first STREAM file 'under' the parent file
TempStr = "File 1"
OPEN $STREAMDIR & "\stream.txt:s1" FOR BINARY ACCESS WRITE LOCK SHARED AS #1
PUT #1, 1, TempStr
CLOSE #1
'// Create second stream file
TempStr = "File 2"
OPEN $STREAMDIR & "\stream.txt:s2" FOR BINARY ACCESS WRITE LOCK SHARED AS #1
PUT #1, 1, TempStr
CLOSE #1
'// Now READ the data from our 3 files (note that only 1 of these files is visible in directory listings)
OPEN $STREAMDIR & "\stream.txt" FOR BINARY ACCESS READ LOCK SHARED AS #1
GET #1, 1, TempStr
CLOSE #1
IF TempStr <> "Parent" THEN
STDOUT "This machine does not support NTFS Alternate Data Streams!"
EXIT FUNCTION
END IF
STDOUT "Data in parent file: " & TempStr
OPEN $STREAMDIR & "\stream.txt:s1" FOR BINARY ACCESS READ LOCK SHARED AS #1
GET #1, 1, TempStr
CLOSE #1
STDOUT "Data in 1st stream file: " & TempStr
OPEN $STREAMDIR & "\stream.txt:s2" FOR BINARY ACCESS READ LOCK SHARED AS #1
GET #1, 1, TempStr
CLOSE #1
STDOUT "Data in 2nd stream file: " & TempStr
STDOUT "---"
STDOUT "Press any key to delete all 3 files ... ";
WAITKEY$
KILL $STREAMDIR & "\stream.txt"
'As this is just a demo and we don't want to leave behind any rubbish, we'll tidy up after ourselves..
'As the ADS files are invisible they can't really be deleted any other way
KILL $STREAMDIR & "\stream.txt:s1"
KILL $STREAMDIR & "\stream.txt:s2"
END FUNCTION
[This message has been edited by Wayne Diamond (edited April 16, 2001).]
Comment