Talk:Alternate data streams

Subversive Technologies & Countermeasures

Embedding a file that contains alternate data streams into another file or directories stream. Does Windows retain the streams of the file that is now become a stream itself? Not sure how Windows handles this situation, when time permits will write some code to traverse streams and see.

Jason Todd 19:51, 24 May 2006 (CDT)

[edit] ADS Spy

While doing a little more research into how Windows XP uses streams to store data for its internal use I noticed that ADS Spy does not pick up on all the streams on a complete system scan. Not sure if its internal code that ignores common windows streams in attempt to not "spam" the output window with "safe" data streams, or a poor detection algorithm.

IExplorer.exe keeps Zone.Identifier streams on downloaded files and other browser specific files, and even keeps a GUID stream on itself. All the other mentioned stream detection programs picked up on these.

Figured it was worth noting and will most likely work these and other results back into the article as I find the time to do more research.

Jason Todd 14:20, 31 May 2006 (CDT)

[edit] Legal Characters

the following command works so there is a different naming convention for streams than for files because "abc??**q.txt" is a legal stream name but not a legal file name echo hello > C:\test.txt:abc??**q.txt

needs more looking in to

I updated the article to incorperate your findings, great find.

Jason Todd 14:25, 24 September 2006 (CDT)