Win Xp And W2k With Ntfs Alternate / Multiple data streams

[NilsC 0]

Alternate / multiple-data steams are an issue (feature) with the NTFS file system. This issue is difficult to deal with if you are in a networked environment.

What are data streams. It's a sequence of bytes. (it's a lot more to this but not necesarry for this tutorial) All files and folders have a 'main' unnamed stream associated with it regardless of the file system used. NTFS differs because it supports additional named data streams that can be added to the file. Why do we need alternate data-streams are they good or bad. The answer is both, they are good when you use them to record a summary with the properties tab. Each stream has a different name and are only visible to NTFS volumes. The bad thing is they can be used to hold viruses, Trojans, backdoors and other exe files and the kicker are a 64kb picture can contain a virus file of any size and the file-size will never change because that data are stored within the alternate data stream.
How to create and view ADS is covered in a lot of other documents / sites so I will not get into that here. Windows Alternate Datastreams

The easy solution to remove alternate data-streams is to have a FAT partition on your computer and save any file you are not sure of. If the file contains ADS it will be removed from the file because FAT can't handle ADS / multiple data streams.

XP will sometimes (not all the time) pop up a message asking you to "Confirm Stream Loss". So to protect yourself from this kind of virus save pictures or songs to a FAT partition and use a batch file or copy paste to move them back to the NTFS partition.


It's a good habit to save files to the FAT table instead of "Open with ...".

Nils