Experiment 3: hidden file: alternate data stream (ADS)

Microsoft added the ADS feature to the NTFS in 1993 to make the FS compatible with other OSs (e.g. Macintosh System 7), and later began using ADS to store some file attributes.

Method

Using Windows, on the non-test partition, create two text files; one with the phrase “Text file #1” and the other with “Text file #hidden!” In the Command Prompt, run

type hidden.txt > file.txt:hidden.txt

to concatenate the hidden file onto the first file as an alternate data stream.

Beginning with Windows Vista, Microsoft made it easier to betray the existence of an ADS. Before changing the DIR command, third party utilities (e.g. [FH1]) were the only way to show that a file contained an ADS. Now, it is as simple as:

C:\Users\Nate\adstest>dir /r Volume in drive C has no label. Volume Serial Number is 8018-4E0C Directory of C:\Users\Nate\adstest 05/16/2011 09:34 AM <DIR> . 05/16/2011 09:34 AM <DIR> .. 05/16/2011 09:33 AM 10 file.txt 6 file.txt:hidden.txt:$DATA 1 File(s) 10 bytes 2 Dir(s) 4,433,068,032 bytes free

Fig. 3.1: The modified text file as it appears in Notepad (foreground) and in a hex editor (NTFS).

Results

This results in a single text file that appears identical to the original and displays only “Text file #1” when opened in a text editor (e.g. Notepad). But under a partition editor, both files appear (Fig. 3.1). Forensics tools are able to find text in a partition, but an investigator may overlook text that appears in the space after a file. This technique is much more useful for delivering malware hidden in the ADS of an inconspicuous file which then may be activated on a target computer.