NTFS Streams Info 2.1

NTFS files contain one primary stream and, optionally, one or more alternate data streams (ADS).

The problem is that Microsoft provides no tools or utilities either within the operating system software distribution or the Resource Kits for detecting the presence of ADSs. When viewing a directory with explorer, or using the dir command in cmd.exe, the information reported pertains to the primary stream only.

NTFS Streams Info is a useful program which lets you to detect and manipulate (read , write or delete) a NTFS alternate data streams.

The existence of NTFS Alternate Data Streams and their potential for misuse has recently been publicised in various NT related newsgroups and mailing lists. These streams can be used to hide the existence of data of any size and type (eg confidential data, images, executable code etc) which may be damaging to your organization. Legitimate uses of streams have also been included in recent editions of some UK PC magazines.

The current problem with streams is that many Windows NT users (including administrators) are not aware that streams exist and even if they know of them have no simply method of detecting them. Microsoft does not provide tools for reporting what streams exist! Intelligence Systems GEO has developed a GUI-based utility which solves the problem of hidden data by checking a machine for the existence of non-default streams (a data and security descriptor stream exists on every NTFS file and directory). The utility searches an NTFS disc locating and reporting the size and the name of every alternate data stream detected. With this tool you can even manipulate with ADSs!