Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Detecting Alternate Data Streams
Standard Windows tools provide two tip-offs to an ADS invasion—one of them subtle, the other sometimes blindingly obvious.
The subtle one is the date stamp on the file. While alternate data streams don't change the reported file size, they do change reported date of file creation. Of course, unless you've kept some sort of record of creation dates, or the altered file sits in the middle of a bunch of files created on the same date, this change is very difficult to spot.
The obvious tip-off is when your hard drive suddenly and mysteriously fills up. The added files won't show up in your directory, but they still take up space on your disk, and that's reported by chkdsk.
While alternate data streams are very hard to detect with Windows, they're easy to find with specialized tools. A number of companies and individuals offer tools to track and remove ADS. Because alternate data streams aren't detected by conventional Windows tools, most ADS detectors use the Windows backup API, which can detect alternate data streams. Usually you must have administrative or backup privileges to run ADS detection software.
- One of the best-known ADS trackers is List Alternate Data Streams (LADS), a freeware utility from Frank Heyne Software.
- TDS-3, an anti-Trojan program from DiamondCS, can also detect ADS.
- Another utility to detect streams is Streams from Sysinternals.
- ADSTools can perform some basic file operations on alternate data streams, as well as detecting them.
Please note that many of the available ADS detectors simply alert you to the existence of alternate data streams, rather than removing them.