NTFS文件流概念和利用

其他附件1

FAQ NTFS and ADS (Unknown) (z-library.sk, 1lib.sk, z-lib.sk).pdf

1. How to Create and Open an Alternate Data Streams File

There are 2 types of ADS files: one is the isolated ADS file and the other is the associated ADS file.

To create an isolated ADS file, the only way is to use command “echo content > :ads filename“. To open the isolated ADS file, you should use command “notepad :ads filename“. Please note that the content and ADS filename should be replaced accordingly.

In most cases, people will create associated ADS files. To create an associated ADS file, you can use echo command or type command. Please refer to the following guide:

Step 1: Open Command Prompt and run it as administrator. Go to the drive where you want to create the ADS file and use dir command to check what files are there. You can check the file type according to the file extension (dir means directory).

Step 2: Create an ADS file and open it.

• **Echo content > host filename:ads filename.**As the following picture shows, the content “partitionwizard.com” is written into the ADS file “ads2.txt“, which is associated with the host file “file.docx“.
• Type ads file > host file: ads file. There are two files in E drive: txt.txt and file.docx. Now I want to make the “txt.txt” file become an ADS file lodged in the host file “file.docx“. I will use the type command.

Tip: 1. If you want to create an ADS file in a subdirectory, you should first open the drive and then use “cd + directory name” to open the subdirectory. 2. The host file and ADS file can be various types, such as executable files, images, documents, folder, compressed file, etc. Please note that the host file can even be a drive (c:, e:, etc.). 3. To check whether the ADS file is crated successfully, you can use command “dir /r“. 4. The ADS file opening method should be changed according to the ADS file types. For example, if the ADS file is a text file, you can open it with notepad; if the ADS file is an image file, you should open it with mspaint. 5. After opening the ADS file, you can then edit it, change it and save it.

Tip: 1. You can run the executable ADS successfully only if it is a complete program file that can run alone (for example, a setup program). Otherwise, it won’t run, because the loss of important files (various .dll files). 2. When I use the first method, I have found a process named file.docx:setup.tmp. When I use the second method, I have found a process named xxads.tmp. This may be the difference between the two methods.

2. How to Detect and Remove ADS Files

To detect ADS files, you can use dir /r command. But this command can only detect the ADS files under the current folder. If you want to detect ADS files under the subfolder, you should open it first (eg. dir ddd) and then use command (eg. dir ddd /r) to display ADS files. Some people may also suggest you use lads.exe tool to detect ADS files.

After finding ADS files, you can delete these NTFS Alternate Data Streams files through the following 3 ways:

1. Delete the host file directly.
2. Move the host file to a non-NTFS partition like FAT32, FAT, etc.
3. Use Streams.exe offered by Microsoft to delete streams.

NTFS vs. FAT32 vs. exFAT – Differences and How to Format to

In this part, I will show you how to wipe Alternate Data Streams using streams.exe. Here is the guide:

• Make sure the Alternate Data Streams files have stopped running.
• Download Streams.exe tool from Microsoft and then unzip it.
• Open the streams folder and move streams app to the root directory of the partition where you want to delete the streams files.
• Run command “streams -d + host file path” This command will delete all ADS files lodged in the host file.After finding ADS files, you can delete these NTFS Alternate Data Streams files through the following 3 ways:
  1. Delete the host file directly.
  2. Move the host file to a non-NTFS partition like FAT32, FAT, etc.
  3. Use Streams.exe offered by Microsoft to delete streams.
  NTFS vs. FAT32 vs. exFAT – Differences and How to Format to In this part, I will show you how to wipe Alternate Data Streams using streams.exe. Here is the guide:
  • Make sure the Alternate Data Streams files have stopped running.
  • Download Streams.exe tool from Microsoft and then unzip it.
  • Open the streams folder and move streams app to the root directory of the partition where you want to delete the streams files.
  • Run command “streams -d + host file path” This command will delete all ADS files lodged in the host file.

Tip: 1. The dir /r command won’t display isolated ADS files. 2. To delete the isolated ADS file, you need to delete its upper directory. But Streams.exe tool can help you delete the isolated ADA file more easily. In the above picture, I have created an isolated ADS file under E directory. You can see the command *streams -d e:* has deleted the isolated ADS file.

其他附件2

3.png

其他附件2