ADS — Alternate Data Stream

Alternate Data Stream (ADS)

Alternate data streams (ADS) are an NTFS feature that allows additional data streams to be attached to files.

ADS is useful, but it has limitations: it works only on NTFS and can be difficult for administrators to manage. It allows useful attributes to be attached to files, but it can also be misused to conceal unwanted content.

Show ADS in a directory

In Command Prompt:

      dir /r

lists all files and shows any alternate data streams beneath each file.

Delete ADS

For this task, I used PowerShell. At the time of writing, I had not found a solution using Command Prompt (CMD).

In PowerShell, you can invoke the directory listing with the /r parameter as follows: cmd /r dir /r

To delete a particular data stream: delete-item .\filename.ext:data-stream