Alternate Data Stream (ADS)
Definition
An NTFS feature that lets a file carry one or more named streams in addition to its default stream, accessed as filename.txt:streamname. Used legitimately by Zone.Identifier and abused by malware to hide payloads.
- Filesystem
- NTFS
- Access syntax
- filename:streamname
- Legitimate example
- Zone.Identifier mark-of-the-web
- Malicious use
- Hiding payloads from casual view
Common questions
How do investigators find alternate data streams on a suspect image?+
Standard directory listings in Windows Explorer do not show ADS content, so examiners rely on forensic tools or command-line utilities that specifically enumerate streams attached to each file, since the streams are invisible to a normal file browse.
Do alternate data streams survive being copied to a non-NTFS destination?+
No, copying a file to a filesystem that does not support ADS, such as FAT32 or most network transfers, strips the extra streams and leaves only the default stream, which is one reason ADS is unreliable for long-term malware persistence outside NTFS volumes.
Related terms
- File Slack
- The unused space at the tail of the last cluster of a file. It can contain remnants of whatever previously occupied that...
- Hiberfil.sys
- The compressed RAM snapshot Windows writes to C:\ when the system hibernates. Recoverable as a memory image with Hibr2Bin or Volatility, often...
- LNK File
- A Windows shortcut that records the target path, target MAC times, the source volume serial number, and the MAC address of the...
- ShellBags
- Registry keys under Software\Microsoft\Windows\Shell\BagMRU and \Bags in UsrClass.dat and NTUSER.DAT that record every folder the user opened in Explorer, including folders on...
- Volume Shadow Copy (VSS)
- Block-level snapshots of NTFS volumes maintained by the Volume Shadow Copy Service for System Restore and backup. Recoverable with vss-tools, ShadowExplorer, KAPE,...