Microsoft added the ADS feature to the NTFS in 1993 to make the FS compatible with other OSs (e.g. Macintosh System 7), and later began using ADS to store some file attributes.

Using Windows, on the non-test partition, create two text files; one with the phrase “Text file #1” and the other with “Text file #hidden!” In the Command Prompt, run

to concatenate the hidden file onto the first file as an alternate data stream.

Beginning with Windows Vista, Microsoft made it easier to betray the existence of an ADS. Before changing the DIR command, third party utilities (e.g. [FH1]) were the only way to show that a file contained an ADS. Now, it is as simple as:

Fig. 3.1: The modified text file as it appears in Notepad (foreground) and in a hex editor (NTFS).

This results in a single text file that appears identical to the original and displays only “Text file #1” when opened in a text editor (e.g. Notepad). But under a partition editor, both files appear (Fig. 3.1). Forensics tools are able to find text in a partition, but an investigator may overlook text that appears in the space after a file. This technique is much more useful for delivering malware hidden in the ADS of an inconspicuous file which then may be activated on a target computer.