Alternate Data Streams in NTFS



There is such a thing as an NT ADS (Alternate Data Streams - alternate data streams). And easier to say: NTFS supports multithreaded files as : ; then eat one file can hold several independent streams differing in name (StreamName). Above these streams is allowed to carry out normal read / write operations, indicating the name of the file later through the colon stream name.
For example, the conclusion to "monitor" a prog redirect to an alternate stream: ping.exe >> somefile.txt: kakashka
The whole trick is that while the explicit file size did not change, as the size of the main axis of Pomeroy (Default) Flow (for treatment which could not spell his name as a colon). But the disk space has become smaller due to the fact that we recorded in the stream kakashka.
How these things are allowed to use, guess himself. :) ))) Of course, in addition to zaseraniya NTFS-volumes for ADS allowed to find even a lot of other applications. For example, molecules are allowed to write a program which is hidden in the alternative flows;)
Bang alternative flow conventional del does not work. The easiest means to get rid of the alternative streams - throw them containing the file to FAT, then back only. There is a program for their discovery. For example «lads». Incidentally, additional threads are allowed to cling well to directories, only files in them is no longer possible to put :)


Copyright by MicroSoft




Material is published with the permission of DHGROUP (http://www.dhgroup.org)