Where is the data stored for the NTFS alternate data streams (ADS) in Windows?

I was playing around with the Alternate Data Streams (ADS) on windows following this example (from MS).

Set-Content -Path .Stream.txt -Value 'This is the content of the Stream.txt file'
Add-Content -Path .Stream.txt -Stream NewStream -Value 'This is the hidden ADS named NewStream'

Now, looking at the file using various utilities tell you nothing about this additional stream. I would have expected that since the data is taken up on the drive, that the size would say something. But none of the common tools (stat, file, dir etc.) show anything.

Of course you can see this by using:

dir /r                                   # CMD
streams.exe                              # Sysinternals
Get-Item -Path .Stream.txt -Stream *    # Powershell

Possibly related resources:

My question is:

Where is the additional data stored?
(And how is it linked to the file?)

Source: Windows Questions

LEAVE A COMMENT