I was playing around with the
Alternate Data Streams (ADS) on windows following this example (from MS).
Set-Content -Path .Stream.txt -Value 'This is the content of the Stream.txt file' Add-Content -Path .Stream.txt -Stream NewStream -Value 'This is the hidden ADS named NewStream'
Now, looking at the file using various utilities tell you nothing about this additional stream. I would have expected that since the data is taken up on the drive, that the size would say something. But none of the common tools (stat, file, dir etc.) show anything.
Of course you can see this by using:
dir /r # CMD streams.exe # Sysinternals Get-Item -Path .Stream.txt -Stream * # Powershell
Possibly related resources:
- MFT information for alternate data stream names
My question is:
Where is the additional data stored?
(And how is it linked to the file?)
Source: Windows Questions