[119154] in Cypherpunks
free utility to list NTFS alternate data streams (w. source)
daemon@ATHENA.MIT.EDU (Dean, James L)
Mon Oct 18 11:37:37 1999
Message-ID: <4DDCE8648ECDD11187910060979C5358A3F677@lsumcbolivar.lsumc.edu>
From: jdean@lsumc.edu (Dean, James L)
To: "'cypherpunks@algebra.com'" <cypherpunks@algebra.com>
Cc: "'csvcjld@nomvs.lsumc.edu'" <csvcjld@nomvs.lsumc.edu>
Date: Mon, 18 Oct 1999 10:21:58 -0500
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Reply-To: jdean@lsumc.edu (Dean, James L)
Under the NTFS file system in Windows NT 4.0, alternate data streams
can be used to hide files. For instance,
echo testing >test.txt
will create an ordinary file.
echo another >test.txt:alternate
will create an alternate data stream. The DIR command will not show
this alternate stream, but
more <test.txt:alternate
will display its contents.
According to the latest issue of Computerworld, hackers are
using alternate data streams to hide their utilities on NT
machines.
My free command line utility at
ftp://colbleep.ocs.lsumc.edu/pub/utility/NTFS/streams.zip
will list the alternate data streams in the files associated with
specified directories and their subdirectories. Source code
is included.
