Hiding Files with NTFS Alternative Data Streams

Alternative Data Stream support was added to NTFS (Windows NT, Windows 2000 and Windows XP) to help support Macintosh Hierarchical File System (HFS) which uses resource forks to store icons and other information for a file. While this is the intended use (as well as a few Windows internal functions) there or other uses for Alternative Data Streams that should concern system administrators and security professionals. Using Alternative Data Streams a user can easily hide files that can go undetected unless closely inspection. This tutorial will give basic information on how to manipulate and detect Alternative Data Streams. More information available here.

In the video below Crash Overron from Infinity Exists shows a demonstration of how to hide files using Alternative Data Streams.

Infinity Exists is a security and hacking video blog.