Alternate Data Stream (ADS)
An NTFS feature that lets a file carry one or more named streams in addition to its default stream, accessed as filename.txt:streamname. Used legitimately by Zone.Identifier and abused by malware to hide payloads.
An NTFS feature that lets a file carry one or more named streams in addition to its default stream, accessed as filename.txt:streamname. Used legitimately by Zone.Identifier and abused by malware to hide payloads.
Practice with mock tests, learn from structured notes, and get your questions answered by a global forensic community, all in one place.