Alternate Data Streams - programs for managing

[jimspoon]

Alternate Data Streams are more interesting now that Void has made them searchable in Everything. I've spent awhile looking for ways to create, edit, find, view, rename, and delete them through a GUI interface, as well as command-line methods.

It won't surprise anyone that Nir Sofer leads the pack with his AlternateStreamView. ( https://www.nirsoft.net/utils/alternate ... reams.html ) It's great for finding and deleting streams, but it provides no way to create, edit, view the contents, or rename them. It does provide a shell extension. You can right-click on a file (e.g. in Everything), and then right click on AlternateStreamView. ASV will then show a list of the ADS in the file. Also, you can right click on a stream in the list, then click Properties. One of the Properties shown is Full Stream Name in the format pathname\filename:streamname. You can highlight the entire name, then press Ctrl+C to copy it to the clipboard. Then you can press Win+R to bring up the Run Dialog, type "notepad.exe " without the quotes, then paste in the "full stream name" you copied from ASV. Press Enter, and the stream will appear in Notepad. You can then view and edit the stream and save the changes.

Note that ASV has an option in the File menu, "Open Selected Stream With" - it doesn't work. As explained on the ASV webpage, "starting from Windows 7, the standard 'Open With' dialog-box of Windows stopped working with alternate streams, and thus the 'Open Selected Stream With...' option provided by AlternateStreamView also doesn't work."

Another useful program is AltStreamOverlay. ( http://www.benf.org/other/alternatestre ... index.html ) You can download the DLLs, copy them to a suitable location, then register them. I was able to register them by right-clicking on the DLLs and clicking "Register". You can also do it with the command line "REGSVR32 <path to DLL>". ASO gives puts a "thumbprint" overlay on a file with ADS - this makes it easy to see if a file has ADS. If you right-click on a file with an ADS, then click Alternate Streams in the right-click menu, a list of ADS in the file will pop up. Clicking on a stream in the list doesn't have any effect, unfortunately. You can also right-click on the file with ADS, then Properties, you'll see an "AlternateStreams" tab in the Properties dialog. On this tab you can select any of the streams in the file and view its contents. You can't edit the contents in this tab, however.

NOTE: if you don't see the "thumbprint overlay on the file icon, you may have too many icon overlays registered. Windows only allows 15. It seems any icon overlay after the first 15 in the alphabetical list simply won't be displayed. I got mine working by putting 5 spaces before the "AlternateStreamOverlayIcon" name. Then it sorts to the top of the alphabetical list. Here is the registry key where the list appears: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers
After a reboot, the ASO icon overlay appeared on my files with ADS.

Another good program is "ADS Manager" at https://dmitrybrant.com/adsmanager . ADS Manager can create ADS, list ADS in a file, view ADS contents, rename ADS, and delete ADS. You can't directly edit and re-save ADS, though. You can export an ADS to a file, edit that file, and then load the contents of the file back into the ADS. You can't use ADS Manager to search for files with ADS; you need to use AlternateStreamView for that.

For creating and editing ADS, I haven't found anything better than Notepad.exe. But as mentioned above, you can't use the File > Open dialog to load a stream into Notepad. You have to use a command line ( notepad.exe pathname\filename:streamname ). If the stream doesn't exist yet, you'll get a prompt, "cannot find the pathname\filename:streamname file. Do you want to create a new file?" Click yes and the stream will be created in the file.

It's too bad that I have to use a command-line to open the stream. I'd like to find a program that has a right-click option to open a stream in Notepad, but haven't found it yet.

Another program: Cudatext with the NTFS_Streams plugin. ( https://cudatext.github.io/download.html ) To install the NTFS Streams plugin, click Plugins, Addons Manager, Install, search for NTFS_Streams, press Enter to install. Use the NTFS Streams plugin by clicking Plugins, NTFS Streams.

Finally I'll mention some Total Commander plugins which I am looking at -
NTFS FileStreams 2.0.6 Beta by Progman13
https://totalcmd.net/plugring/NTFSFileStreams2.html (added 3.07.2014)
NTFS FileStreams 1.0 by Shurshik
http://totalcmd.net/plugring/NTFSFileStreams.html (last update 14.09.2005)
NTFSStream 1.0.1.59 by Tir Na Nog
http://totalcmd.net/plugring/ntfs_stream.html (updated 1.12.2009)
NTFSFileStreams.wdx 1.2 by Progman13
https://totalcmd.net/plugring/wdx_ntfs_ ... reams.html
added 23.06.2014 updatd 2.04.2021
NTFS Descriptions 1.2.1 by Led
https://totalcmd.net/plugring/NTFS_diz.html
added 2.01.2010, updated 17.10.2011

I haven't gotten very far into Total Commander or these plugins so I don't have much to say about them yet. I haven't figured out how to do much with ADS in Total Commander yet.

[tuska]

I haven't figured out how to do much with ADS in Total Commander yet.

Hi,
If you look around a bit in the Everything forum, you can discover this post..."Ability to Search Tags"

Total Commander with Plugin "NTFS Descriptions 1.2.1":
After download, a double click *in Total Commander* on the file "wdx_NTFSDiz.zip" starts the installation.

You can find a complete example including pictures and settings here.
[In my opinion, it is advisable to read the entire topic...]

[harryray2]

Thanks for that the AlternateStreamOverlayIcon is what I was after as it adds a tab to the properties box.

Couple of things...When you say put 5 spaces in front of the name do you mean in the registry?
When I look at the tab in the properties, in the ::$data section I can only seem to view the whole text in hex but not in text. Any idea why?

Thanks.

[jimspoon]

Yes ... if you don't see the thumbprint over the lower left corner of the icon for the file that has ADS - run regedit and go to this key:
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\
Below that you'll see a list of all the icon overlays registered on your system, in alphabetical order. Those after the 15th will not get displayed. In that case you'll need to put spaces before the name "AlternateStreamOverlayIcon" so that it appears at the top of the list. I had to put 5 spaces in front of it so it would appear at the top of the list. Then I rebooted and then I could see the thumbprint on the icon.

I looked at a test text file in the properties box, and I see that for the ::$DATA stream it shows only "ÿþt" in text mode. Only when I click "Show as Hex" can I see the text. The ::$DATA stream is the unnamed or primary data stream, which is often the only data stream in a file. When I click on the named (alternate) data streams that I created, the text is shown properly in text mode. I don't know why the ::$DATA stream is not displayed properly in text mode. But since it's the primary stream, we don't have much difficulty viewing its contents, it's the alternate streams that are a bit harder to view.

[NotNull]

A couple of other programs:
NTFS Stream Explorer (http://hex.pp.ua/ntfs-stream-explorer-eng.php)
- portable
- unsigned


Stream Detector (https://www.novirusthanks.org/products/stream-detector/)
- portable version available
- signed
- can also create named streams



7-zip
7-zip comes with a quite powerful dual pane filemnanager (7zfm.exe) that can view and delete named streams (among other features not found in *any* filemanager).


There was (is?) also a GUI frontend for either LADS or STREAMS (both are command-line utilities that can manage data streams).
But can't remember as this was all too long ago, when XP was just released. So better ignore this

[NotNull]

When I look at the tab in the properties, in the ::$data section I can only seem to view the whole text in hex but not in text. Any idea why?

Wild guess: different encoding of the file.

[harryray2]

I couldn't even begin to guess...I can't find any way round it other than open in the hexview then copy into a text file and try to filter bits out to make it more readable.

[therube]

(Corrected download link from OP's post, https://cudatext.github.io/download.html)

[jimspoon]

Hi Harry, I looked at another text file with ADS in the AltStreamOverlay properties page. This time the text displayed properly in text view. So I think it is something to do with the encoding of the particular file as NotNull said. My guess is that the AltStreamOverlay can't display text encoded as Unicode, but only ANSI-encoded text?

[jimspoon]

Thanks Therube for catching that wrong URL, I fixed it in the OP.

[harryray2]

Thanks for looking...I assume there's no way round it?

[jimspoon]

I haven't figured out how to do much with ADS in Total Commander yet.

Hi,
If you look around a bit in the Everything forum, you can discover this post..."Ability to Search Tags"

Total Commander with Plugin "NTFS Descriptions 1.2.1":
After download, a double click *in Total Commander* on the file "wdx_NTFSDiz.zip" starts the installation.

You can find a complete example including pictures and settings here.
[In my opinion, it is advisable to read the entire topic...]

Hi Tuska,

Thanks! I have been going through that thread again and experimenting. Thanks for all the great screenshots and annotations you put in.

So NTFS_diz property names are defined in NTFS_diz.ini [Streams] section, with a format 0=<property name> through 9=<property name>. These properties are stored in NTFS streams with the same names as the NTFS_diz property names. In TC, you can create these streams in a file using the File > Change Attributes command. In the Change Attributes dialog, you click More Attributes to add an attribute. Then you select the plugin, the plugin property, and type in the Value to be stored in the stream. It seems that to actually add these properties/streams, you have to have the Change Plugin Attributes box checked before you click the OK button. ANSI encoding is used for the created streams. I created a custom columns set including the NTFS_diz properties as columns. (Configuration > Options > Custom Columns > New > Add Column > Field Contents dropdown > ntfs_diz plugin > Comment, etc.) The content of the NTFS_diz properties were added in columns, but it doesn't seem I can edit them in place or anything like that - I'd have to go back to Change Attributes for that I think.

OK, so now in Everything these streams created by TC and NTFS_diz can be mapped to Everything properties using the Everything.ini setting property_alternate_data_stream_ansi- . The NTFS_diz properties/streams can be mapped to Everything "custom_property_0" through "custom_property_9". And the custom names can be assigned to these Everything custom properties in INI settings using a custom_property_0=<custom name> format.

I found that the streams created by NTFS_Diz show up in the stream viewer programs like any other streams. If a file already had other streams with different names than the names specified in NTFS_diz.ini, NTFS_diz leaves those named streams alone, and simply adds its own streams.

[jimspoon]

NotNull, thanks for the references to Stream Explorer, Stream Detector, and 7-Zip File Manager. I particularly like what I can do with 7-Zip file manager, especially that I can right-click on a stream name and then Edit. This opens up Notepad, and when I save the changes are saved in the stream.

[jimspoon]

I'll throw one more program at you, and if you can get it working right, it may be the most remarkable of all - the Alternate Data Streams Shell.

The web address has an unfortunate name - http://www.evilapp.com/help/adsshell/index.html#top . I don't think his programs are evil, rather his idea is that "applications are evil" and "A website devoted to saving the world from applications". So he designs shell extensions to do what otherwise require separate apps.

In short, this Shell makes alternate data streams appear as if they were files in themselves. Say you have a file adstest.txt which has alternate data streams, say "stream1.txt" and "stream2.txt". The Shell creates a sidecar folder called "adstest.txt_streams" inside this folder would be files called "stream1.txt.adslnk" and "stream2.txt.adslnk". In most cases the ".adslnk" extension will be hidden.

If you double click on the "stream1.txt" link file, it loads into Notepad, and you can edit it there.

What''s more, if you type "stream1.txt" in Everything, Everything will show you this "stream1.txt.adslnk" file. And its contents will be displayed in the Everything Preview Pane.

So that is one cool trick.

So far I have not been able to get some features to work. For example, you are supposed to be able to right-click inside the "adstest.txt_streams" folder and then click New > "Alternate Data Stream link". At this point it's supposed to create a link to a non-existent stream in adstest.txt. When you right-click and click Open on this new link, it's supposed to create the ADS and let you edit it. I haven't gotten this to work. And if you try this, you may find that other methods of creating ADS in this file won't work either, until you reboot. So you may want to avoid trying this. On the other hand if there is some genius out there who can figure out how to get it working, that would be cool.

There are some other interesting features mentioned on the help page link mentioned above, but I haven't really explored them yet.

[jimspoon]

I'll throw one more program at you, and if you can get it working right, it may be the most remarkable of all - the Alternate Data Streams Shell.

The web address has an unfortunate name - http://www.evilapp.com/help/adsshell/index.html#top . I don't think his programs are evil, rather his idea is that "applications are evil" and "A website devoted to saving the world from applications". So he designs shell extensions to do what would otherwise require separate apps.

In short, this Shell makes alternate data streams appear as if they were files in themselves. Say you have a file adstest.txt which has alternate data streams, say "stream1.txt" and "stream2.txt". The Shell creates a sidecar folder called "adstest.txt_streams" inside this folder would be files called "stream1.txt.adslnk" and "stream2.txt.adslnk". In most cases the ".adslnk" extension will be hidden.

If you double click on the "stream1.txt" link file, it loads into Notepad, and you can edit it there.

What''s more, if you type "stream1.txt" in Everything, Everything will show you this "stream1.txt.adslnk" file. And its contents will be displayed in the Everything Preview Pane.

So that is one cool trick.

So far I have not been able to get some features to work. For example, you are supposed to be able to right-click inside the "adstest.txt_streams" folder and then click New > "Alternate Data Stream link". At this point it's supposed to create a link to a non-existent stream in adstest.txt. When you right-click and click Open on this new link, it's supposed to create the ADS and let you edit it. I haven't gotten this to work. And if you try this, you may find that other methods of creating ADS in this file won't work either, until you reboot. So you may want to avoid trying this. On the other hand if there is some genius out there who can figure out how to get it working, that would be cool.

There are some other interesting features mentioned on the help page link mentioned above, but I haven't really explored them yet.

[harryray2]

Looks interesting, I'll experiment with it when I get some time...

[NotNull]

I'll throw one more program at you, and if you can get it working right, it may be the most remarkable of all - the Alternate Data Streams Shell.

Very nice find!

I was just playing with it a bit and ran into the same issues.
Without all the technicalities: those were caused by the preview handler. To 'solve' it:
- switch off the preview pane in Everything
- switch off the preview pane in File Explorer
- If needed, kill the prevhost.exe process (preview handler host) in Task Manager.

After these steps, things started to work as expected.



And another program for your list: ADS Spy

http://www.merijn.nu/programs.php#adsspy
(From the original author of HiJackThis)
Very basic, but fast, tool to scan and delete named streams.
It does not require elevation (the tools I mentioned earlier do)

[harryray2]

I ran ads spy through virus total and got five hits...I normally ignore if it's just one ore two.

Having said that all 5 hits are from what I call the 'silly' vendors'

[therube]

(merijen's been around for a while. All those tools are OLD, at this point. In the past I dabbled with many of them.
And if the files are also hosted on other sites, like BleepingComputer, you've got to expect that they've been over them a time or two.)

[jimspoon]

I was just playing with it a bit and ran into the same issues.
Without all the technicalities: those were caused by the preview handler. To 'solve' it:
- switch off the preview pane in Everything
- switch off the preview pane in File Explorer
- If needed, kill the prevhost.exe process (preview handler host) in Task Manager.

After these steps, things started to work as expected.

Thanks for figuring out the "fix"! I will now try out some more of the features of ADS Shell.

[jimspoon]

Regarding ad shell, I've yet to play with it but am I reading the details on the site correctly, it doesn't search in sub folders?

Right. ADS Shell is not really an "ADS finder" utility. Use AlternateStreamView for that or add Everything's "Alternate Data Stream Count" property as a column.

ADS Shell will create links to ADS that are inside a file. The links themselves are .adslnk files - the .adslnk extension is hidden when you view the .adslnk files in Explorer. The .adslnk files are put inside a sidecar folder with a name like "adstest.txt_streams", at the same level as the file with the streams (adstest.txt). You can then find, view, edit the streams themselves through the link files.

If you were to use Everything and its Alternate Data Stream Count column to find all the files with ADS, and then highlighted them all, and then right-clicked on them, ADS Shell might create sidecar folders with .adslnk files for every one of them all at once. Haven't tried it yet though.

Here is an odd twist - if you have a folder "adstest" that has files inside of it (e.g. adstest1.txt, adstest2.txt) that have ADS in them, and you right click the adstest folder, ADS Shell creates a sidecar folder at the same level as the adstest folder, named adstest_streams. The adstest_streams folder contains .adslnk files linking to each of the files inside the adstest folder. These .adslnk files are links to the files, not to the streams inside of those files. If you double-click on one of these .adslnk files, you'll open up the primary, unnamed stream of the file. At the moment I don't understand how this could be useful. But the Help page does mention using the context menu of a folder to search for streams, so I tried it out.

[jimspoon]

And another program for your list: ADS Spy

http://www.merijn.nu/programs.php#adsspy
(From the original author of HiJackThis)
Very basic, but fast, tool to scan and delete named streams.
It does not require elevation (the tools I mentioned earlier do)

Thanks for adding this one ... you can also right-click on a found stream and click View Stream Contents. Not only can you see the stream contents but you can click the "Edit in Wordpad" button. I edited a stream in Wordpad and the edits were saved to the selected stream. The edits were not immediately shown in the first instance of ADS Spy, but if you repeat the search, relocate the stream in the list, and click View Stream Contents, you'll see revised text of the stream.

So right in ADS Spy you can find, view, edit, delete ADSs.

[harryray2]

I've just been playing with adsshell...all I seem to get are zero byte files.

[jimspoon]

I've just been playing with adsshell...all I seem to get are zero byte files.

I just experimented a little. I created a file adstest1.txt with an ADS "stream1.txt". I right-clicked on adstest1.txt, then clicked on "Preview Streams". ADS Shell creates a folder "adstest1.txt_streams" with a file inside "stream1.txt.adslnk"; the ".adslnk" extension is hidden. The size of "stream1.txt.adslnk" is shown as 0. I right-clicked inside the same folder, then New, then Alternate Data Stream Link; I named it stream2.txt. Its real name is stream2.txt.adslnk and when I double-clicked it, ADS Shell created another stream in adstest1.txt named stream2.txt, and opened it in Notepad. I inserted some text and saved the stream. The stream2.txt.adslnk file shows as a zero byte file but when I opened up adstest1.txt in ADS Manager, ADS Manager shows that stream2.txt has 62 bytes.

So ADS Shell makes the "stream2.txt" appear as a file, but it can only go so far; Windows doesn't show the stream size as the size of the "file".

[NotNull]

So ADS Shell makes the "stream2.txt" appear as a file, but it can only go so far; Windows doesn't show the stream size as the size of the "file".

I don't have it installed anymore, so from memory: you have to right-click the host-file and choose "Update ....".
(Or was it the sidecar folder you have to right-click?)

[jimspoon]

To display the sidecar folder containing the links to streams, right-click the host file and then Preview Streams. I think the link files actually get created when you do that.

To create a new stream inside the host file, I right-clicked an empty space inside the sidecar folder, then New, then Alternate Data Stream Link.

[NotNull]

This is what I meant: Right-click the straems folder and choose Update streams folder
The new size will be shown in the :Stream size column.

2021-07-27 21_59_08-T__adsshell-1.4-amd64.png (26.58 KiB) Viewed 65825 times

2021-07-27 22_04_49-T__adsshell-1.4-amd64_host.txt_streams.png (25.78 KiB) Viewed 65825 times

[jimspoon]

Thanks for posting that! If I even noticed that capability, I forgot it. I should have known there would be a way to see the stream size. The author of ADS Shell, whose name is Alexey, was very thorough.

[harryray2]

I normally copy files with Teracopy which also copies over the ADS but I've just come across a hidden file, that when copied over, loses the ADS.

The file name is LIC and I'm assuming it's some sort of license file.
Any idea of how this file could be copied and retain the ADS?

[jimspoon]

Are you copying to a destination other than an NTFS drive? ADS are lost when copying to a non-NTFS drive, or when attached to an email. When copying NTFS to NTFS, they should be preserved.

[harryray2]

All other files copy over OK, I'm not sure how but I think it's some sort of security to stop the ADS being copied. I imagine that the ADS is something to do with the license for the software.


I just discovered that I already have a programme that will duplicate the file with the ADS.

[jimspoon]

What is the formatting of the volume to which the file is being copied? Is it NTFS? FAT32? Right-click on the drive, Properties, General tab, File System.

[harryray2]

It's NTFS, but as I said, all other files with ADS copy OK. It's just this one.

I'ts a zero byte file so I suspect that the names (4 of them) of the ADS have something to do with the license activation.

[horst.epp]

It's NTFS, but as I said, all other files with ADS copy OK. It's just this one.

I'ts a zero byte file so I suspect that the names (4 of them) of the ADS have something to do with the license activation.

I guess the product installed some file system filter driver
which prevents modification.
I would deinstall such a tool.