I found one, but it seems to support XP only (I'm not sure) http://www.codeproject.com/KB/shell/csadsdetectorarticle.aspx
Do you know any alternate data stream plug-in or add-on for Windows 7?
Asked
Active
Viewed 3,379 times
5 Answers
2
This article explains ADS well, but most of the links no longer work: dissecting-ntfs-hidden-streams
My top choice would be Microsoft's Streams utility. A good alternative with a graphical user interface is Nirsoft's AlternateStreamView.
James T
- 9,941
- 4
- 28
- 30
-
The article moved, screenshots are lost and most programs links are dead. https://www.forensicfocus.com/articles/dissecting-ntfs-hidden-streams/ – Arioch 'The Dec 09 '20 at 11:47
-
Thanks @Arioch'The. Hopefully this updated answer is more useful. – James T Dec 16 '20 at 01:01
1
One of the best utilities I've found for working with ADS is Streamarmor. It's standalone but has a lot functionality.
It's also freeware :)
Umber Ferrule
- 3,439
- 9
- 40
- 54
Pulse
- 4,523
- 2
- 19
- 20
1
$ streams -64
streams v1.60 - Reveal NTFS alternate streams.
Copyright (C) 2005-2016 Mark Russinovich
Sysinternals - www.sysinternals.com
usage: streams [-s] [-d] <file or directory>
-s Recurse subdirectories
-d Delete streams
-nobanner
Do not display the startup banner and copyright message.
$
phuclv
- 26,555
- 15
- 113
- 235
user1295151
- 21
- 1
-
what's `streams`? And how does it handle ADS **in explorer**? This isn't a good answer at all – phuclv Apr 08 '21 at 04:21
0
NoVirusThanks offers their StreamDetector package for free.
Microsoft also offers Streams as part of the Windows Sysinternals package.
Both executables can be used without requiring installation, and both allow the automated removal of alternate data streams.
Hannah Vernon
- 548
- 1
- 9
- 21
0
One more GUI-based explorer:
- http://hex.pp.ua/ntfs-stream-explorer.php ( more of desciption )
- http://hex.pp.ua/ntfs-stream-explorer-eng.php ( short but in English )
E-SET seems to be fuzzy about safety of it though.
- http://virusscan.jotti.org/filescanjob/zt1smrhnz4
- http://www.virustotal.com/gui/url/75722cb18886e4b6501eb495d77a5e8a4c9e0f0203e966b4440768a60b56fe93 (but it was "all green" 10 months ago)
If one uses Unreal Commander or Total Commander (or maybe there are more WFX-aware file managers) then also https://totalcmd.net/plugring/NTFSFileStreams2.html
Arioch 'The
- 133
- 7