NTFS Alternate Data Streams in Window
NTFS Alternate Data Streams in Window is a method where you can hide one file data into another file data. this is alternate data streams available only on NTFS file system of window
Scenario: If you created a text file with name firstfile.txt in notepad and write some matter inside the file. You can see what is written inside the file anytime. Now you create another file name secondfile.txt and you make some entry in this file. Is it possible to hide second file matter into firstfile. And if someone open first file, should be unable to see hidden data into first file only first data should be visible. Answer is yes and it is happened with NTFS stream. And you can see hidden matter when you want.
Create NTFS Alternate Data Streams
The NTFS file system provides applications the ability to create alternate data streams of information. By default, all data is stored in a file’s main unnamed data stream, but by using the syntax ‘file:stream’, you are able to read and write to alternates. Not all applications are written to access alternate streams, but you can demonstrate streams very simply. First, change to a directory on a NTFS drive from within a command prompt.
Next, Open terminal and type following command
echo “This is data of first file > firstfile.txt
you have just created a file named firstfile.txt.
Next, run following command to write strem.
echo “This is second data stream” > firstfile:scondfile
You’ve just created a stream named ‘secondfile’ that is associated with the file ‘firstfile’. Note that when you look at the first file you will find only enter text when opened in any text editor. To see your hidden stream run following command.
more < firstfile:secondfile
Delete NTFS Alternate Data Streams from the file
NT does not come with any tools that let you see which NTFS files have streams associated with them, and cant be deleted this stream. So you have need some extra software to download software https://technet.microsoft.com/en-us/sysinternals/bb897440.aspx