DarkStreams

Alternate Data Streams (ADS) are additional, invisible data segments that can be attached to NTFS files or folders.
They store information separately from the main file content, without appearing in Explorer or affecting the reported file size.
ADS are useful for hidden metadata, configuration values, or supplemental information, but they always remain tied to the file or folder they belong to.
They are not apparent in normal file system views and are difficult for typical users to access.

ADS is supported only on NTFS formatted volumes.

New: DarkStreams™ is a viewer and editor for ADS with extensive features.

Features

• View ADS content (plain text or binary)
• Edit ADS content (plain text editor or hexadecimal editor)
• Delete ADS (single ADS or all together)
• Export ADS content to file
• Import ADS content from file
• Add and append ADS content
• Progressive search functionality with filters and regular expressions support
• Export scan results to CSV

Possible Applications of ADS

• Store app-specific metadata.
• Save checksums, signatures, hashes, etc.
• Hidden configuration or cache data.
• Simulate extended attributes.
• But also Malware sometimes hides payloads in ADS.