Information on Windows Alternate Data Streams

[DeMario]

Hi,
What is Alternate Data Streams or ADS in short. I heard that this is a security bug and used by hackers. A articles states that it is mainly used by the creators of viruses and hackers. Is it a application in Windows. Does every Windows computer has this computer. How to remove this if I found the same. This looks really fascinating that the widely used Windows computer has one critical bug in it.

[Spyrus]

ADS is an acronym that means: Alternate Data Stream. In French this would result in additional data streams. This technique applies only to systems management files NTFS. This is in fact to add a file or a folder, a new data stream. You, you have normal access to one data stream, such as when reading a text file, c ' is the "normal flow".

[Snake08]

In the case of NTFS offers the possibility of adding one or more to a single file. These additional flows are somewhat meta-data, which are normally invisible. Not just invisible as cookies, they are completely invisible! That is to say that with Windows Explorer you have no chance of detecting them. Besides, you will not even know their size. Here you can understand the interest that could arise from such a technique virus writers.

[Zachary]

The ADSs have been created in order to provide compatibility with HFS, the management system of files under Mac. Without going into details, the goal was to create a file server with Windows clients such as Mac. Also note that these flows can be of any type, not only simple text but also images and even executable! However, any movement of data into another system management files (FAT16, FAT32, etc) will destroy these meta-data. For example transfer files to a floppy.

[Devasis]

ADS is a feature of NTFS that goes back to ancient times (already supported under Windows 3.11!) Which was introduced by Microsoft in the beginning to ensure compatibility with the Macintosh HFS (Hierarchical File System). Mac files have no extension in the file name itself ... The data that says what a Mac file association was used to a fork separate the file name itself. Apparently this has changed since MAC OS X, but the ADS on windows used today in various other tasks.

[Solomon]

The ADS (Alternate Data Stream) are completely invisible (except to use some specialized utilities, usually free, developed by those who found their lives - see Anti-ADS (Anti-Alternate Data Stream). The flow ADS (Alternate Data Stream) attached to all objects of a management system (NTFS files but also directories, including root volume). Any number of flow ADS (Alternate Data Stream) can be attached to the same object. The flow ADS (Alternate Data Stream) were not suspected by the user, it has no reason to try to analyze, let alone remove them.