NTFS Alternate Data Streams: How to Find, Read and Remove Them
On an NTFS drive, a file can carry extra named streams of data that do not show up in its size, in File Explorer or in a normal dir listing. These are alternate data streams (ADS). Windows uses them for ordinary things, most visibly the “this file came from the internet” warning, but attackers have also used them to hide payloads and data. This article shows how they work with commands you can run on a test folder, how to find them, how to remove them, and what defenders should know.
What an alternate data stream is
An NTFS file is really a set of streams. The content you normally see is the unnamed default stream, whose full name is filename::$DATA. NTFS allows additional named streams attached to the same file, written filename:streamname. Each stream has its own content and its own size. Explorer and dir report only the size of the default stream, so a file that looks like 5 bytes can carry megabytes in another stream.
ADS exist on NTFS, and on ReFS as well. They do not exist on FAT32 or exFAT, which is why they vanish when a file is copied to such a drive, emailed, or put in some archives.
Try it safely
Use a scratch folder on an NTFS drive. In Command Prompt:
mkdir C:\ads-demo
cd C:\ads-demo
echo Visible content > Testfile.txt
echo Alternate Data Here > Testfile.txt:ADS
dir
dir /r
more < Testfile.txt:ADSWhat each line does:
- The second
echowrites text into a stream namedADSonTestfile.txt. The file’s normal content is unchanged. - Plain
dirlistsTestfile.txtwith the size of the visible text only, and no sign of the stream. dir /r(“show alternate data streams”) adds an extra line such asTestfile.txt:ADS:$DATAwith its size, revealing the hidden stream.more < Testfile.txt:ADSreads the stream back. Plaintypedoes not accept stream names, which is whymore <or Notepad (notepad Testfile.txt:ADS) is used.
The same thing in PowerShell, which is easier to script:
Set-Content -Path .\Testfile.txt -Stream ADS -Value 'Alternate Data Here'
Get-Item .\Testfile.txt -Stream *
Get-Content .\Testfile.txt -Stream ADS
Remove-Item .\Testfile.txt -Stream ADSGet-Item -Stream * lists every stream with its length. You will always see :$DATA (the normal content), plus any named ones. The last line deletes only the extra stream and leaves the file intact.
Legitimate uses you have already seen
The best-known example is Mark of the Web. When a browser or mail client saves a file from the internet, Windows adds a stream called Zone.Identifier containing something like ZoneId=3. That is what triggers the SmartScreen prompt or “Open File – Security Warning” when you run a downloaded program, and it is what makes Office open documents in Protected View. You can look at it yourself:
Get-Content .\downloaded-file.zip -Stream Zone.IdentifierClicking Unblock in a file’s Properties, or running Unblock-File .\downloaded-file.zip, simply deletes that stream. Some older applications and Windows features also store metadata in named streams, and backup software and cloud-sync clients may use them.
Why defenders care
Because ADS are hidden from normal tools, they are a known technique for concealing data and payloads: MITRE ATT&CK lists it as Hide Artifacts: NTFS File Attributes (T1564.004). Attackers have stored scripts or executables in a stream of an innocuous file and then launched them with a helper such as PowerShell or WMI. Modern Windows blocks running a program directly from a stream in many cases, and Microsoft Defender and most antivirus products scan streams, so the technique is less powerful than it was. Still, it is worth checking for on servers and forensic images. Note also that ADS are not a magic malware indicator: Zone.Identifier is on nearly every downloaded file.
How to find ADS
- Current folder, Command Prompt:
dir /r, ordir /r /sto include sub-folders. - PowerShell, a scan of files below a folder (add
-Forceto include hidden and system files; folders can carry streams too), ignoring the normal data stream and the standardZone.Identifier:Get-ChildItem -Path C:\Users -Recurse -File -ErrorAction SilentlyContinue | Get-Item -Stream * -ErrorAction SilentlyContinue | Where-Object { $_.Stream -notin ':$DATA','Zone.Identifier' } | Select-Object FileName, Stream, Length - Sysinternals Streams:
streams.exe -s C:\pathlists streams recursively, andstreams.exe -d filedeletes them. It is free from Microsoft.
File Explorer’s Properties dialog does not list streams. The Security-tab steps in the old version of this article were incorrect and are not a way to find ADS.
How to remove ADS
- Delete one stream:
Remove-Item file.txt -Stream StreamName. (Sysinternalsstreams.exe -d file.txtdeletes all named streams, includingZone.Identifier.) - Remove Mark of the Web:
Unblock-File file.exe, but only for files you trust. - Strip every stream by copying: copying the file to a FAT32 or exFAT volume, or re-creating it (for example,
Get-Content file.txt -Raw | Set-Content clean.txtfor text) leaves only the default stream. This is a cleanup method, not an investigation method, so do it after you have examined what the stream contains.
The attrib -s -h command is not a way to remove streams: it only changes the file’s system and hidden attributes. Also, if a stream contains something suspicious, do not simply delete it. Preserve a copy in a safe place first, scan the file, and treat the machine as potentially compromised.
Common questions
Do alternate data streams increase disk usage?
Yes. They occupy real space, even though Explorer and dir do not add it to the file’s size. That is one reason a disk can look fuller than the visible files suggest.
Can I use ADS to hide files safely?
No. They are not encrypted, are easily listed with dir /r, and are lost when the file is copied to storage or by tools that do not preserve streams, such as FAT32 or exFAT. For privacy use BitLocker or an encrypted container; see the BitLocker guide.
Does Linux or macOS have something similar?
Yes. Linux and macOS have extended attributes (xattrs), and older Mac file systems used resource forks. When a Mac writes to an NTFS or SMB share, these can show up as extra ._ files.
To understand where NTFS fits among file systems, read Windows file systems compared.
