Streams

NTFS files can contain multiple streams of data. Each stream resembles a separate file but is listed within a single filename. Streams are accessed using the syntax file:stream, and by default, the main stream is unnamed (and hence is accessed when you simply specify the filename).

For example, you can use the echo command to create a file or a specific stream. To create a stream named Data for the file named Text.txt, run the following command.

Directory listings will show that the Text.txt file is zero bytes long, and opening the file in a text editor will show nothing. However, it does contain data in the Data stream, which you can demonstrate by running the following command.

More < text.txt:data

  Hello, world

Legitimate programs often use streams. However, malicious software also uses streams to hide data. You can use the Streams program, available at http://technet.microsoft.com/en-ca/sysinternals/bb897440.aspx, to list streams. For example, to list all files with streams within the Windows directory, run the following command.

Streams -s %windir%

  Streams v1.56 - Enumerate alternate NTFS data streams
  Copyright (C) 1999-2007 Mark Russinovich
  Sysinternals - www.sysinternals.com

  C:\Windows\Thumbs.db:
	:encryptable:$DATA 0
  C:\Windows\PLA\System\LAN Diagnostics.xml:
	:0v1ieca3Feahez0jAwxjjk5uRh:$DATA 2524
	:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}:$DATA 0
  C:\Windows\PLA\System\System Diagnostics.xml:
	:0v1ieca3Feahez0jAwxjjk5uRh:$DATA 5384
	:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}:$DATA 0
  C:\Windows\PLA\System\System Performance.xml:
	:0v1ieca3Feahez0jAwxjjk5uRh:$DATA 500
	:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}:$DATA 0
  C:\Windows\PLA\System\Wireless Diagnostics.xml:
	:0v1ieca3Feahez0jAwxjjk5uRh:$DATA 3240
	:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}:$DATA 0
  C:\Windows\ShellNew\Thumbs.db:
	:encryptable:$DATA 0
  C:\Windows\System32\Thumbs.db:
	:encryptable:$DATA 0

As you can see from this output, several files in subdirectories within the C:\Windows\ directory have a stream named $DATA.