Glossary
Alternate Data Stream (ADS)
An additional named $DATA stream attached to an NTFS file, invisible in Explorer, used for Mark of the Web and sometimes to hide data.
An Alternate Data Stream (ADS) is an extra, named $DATA attribute attached to a file or directory on NTFS. The normal content of a file lives in its unnamed stream; any number of named streams can sit alongside it, addressed with the syntax file.txt:streamname. Explorer and a plain dir do not show them, and the file size reported by Windows ignores them.
Windows itself uses ADS legitimately. The best-known example is the Zone.Identifier stream that carries the Mark of the Web on downloaded files (see Zone.Identifier). Attackers, however, can use streams to hide payloads, scripts or stolen data behind an innocent-looking file.
Streams are easy to list on a live system:
dir /r C:\Users\Public\Downloads
Get-Item .\invoice.pdf -Stream *
Offline, each stream appears as its own $DATA attribute in the file's record in the $MFT, so MFT parsers can report every stream name and size, and small streams can even be read directly as resident data. Keep in mind that streams are lost when a file is copied to a file system that does not support them, such as FAT32, or transferred through many archive and upload paths, so collect evidence from the original NTFS volume.
Related artifacts
- Mounted Disk Images (ISO, IMG, VHD, VHDX)Mounted disk images cheat sheet: ISO/IMG/VHD/VHDX mounts, VHDMP events, MountedDevices, LNK and Jump List traces, Mark-of-the-Web gaps and a detection workflow.
- Windows Subsystem for Linux (WSL)WSL cheat sheet: Lxss registry key, WSL1 rootfs vs WSL2 ext4.vhdx, bash_history inside distros, wsl.exe execution traces, wsl$ share access and evasion.
- Zone.Identifier (Mark of the Web)Zone.Identifier cheat sheet: Mark of the Web ADS, ZoneId 0 to 4, ReferrerUrl and HostUrl per browser, loss and bypass cases, and collection from the $MFT.