Difference between "normal" files and NTFS-file streams ?

[Theo Meckins]

With a tool I found out that some, but not all (approx 2% of my files) are NTFS
streams instead of normal files.

What exactly are NTFS streams?

Can I convert them back to "normal" NON-stream files ?

Theo

 

[Jim]

With a tool I found out that some, but not all (approx 2% of my files) are
NTFS
streams instead of normal files.

So, what problem does this cause?

What exactly are NTFS streams? www.ntfs.com

Can I convert them back to "normal" NON-stream files ?

Unless something is broken, there is nothing to fix.
Jim

 

[Guest]

Are you having any problems ?? If not, leave your files alone.

MD

 

[Wesley Vogel]

Any file on an NTFS formatted drive can have ADS, Alternate Data Streams.

On NTFS alternate data streams can be created by using the Summary tab.

[[A data stream is a sequence of bytes. An application populates the stream
by writing data at specific offsets within the stream. The application can
then read the data by reading the same offsets in the read path. Every file
has a main, unnamed stream associated with it, regardless of the file system
used. However, NTFS supports additional named data streams in which each
data stream is an alternate sequence of bytes as illustrated in Figure x.
Applications can create additional named streams and access the streams by
referring to their names. This feature permits related data to be managed as
a single unit. For example, a graphics program can store a thumbnail image
of a bitmap in a named data stream within the NTFS file containing the
image.]]

[[FAT volumes support only the main, unnamed stream, so if you try to copy
or move a file to a FAT volume or floppy disk, you receive an
error message as shown below. If you copy the file, all named data
streams and other attributes not supported by FAT are lost.]]
from...
Multiple Data Streams
http://www.microsoft.com/technet/prodtechnol/winxppro/reskit/c13621675.mspx

Link has changed.

Working with File Systems
http://www.microsoft.com/technet/prodtechnol/winxppro/reskit/c13621675.mspx

Click on...
Using the NTFS File System
and scroll down to...
Multiple Data Streams

Or do a Ctrl + F for Multiple Data Streams.

-----------------------
Confirm Stream Loss
-----------------------
The file 'xxxxxxxxxxxxx.zzz' has extra information
attached to it that might be lost if you continue copying. The
contents of the file will not be affected. Information that might be
lost includes:
Summary Info
Document Summary Info

Do you want to proceed anyway?
-----------------------

Click YES because there is nothing you can do about it.

With a Word .doc you can access Summary info from the File Properties
without opening the file or you can access that info by opening the file,
clicking File and then Properties.

If you add Comments to a .txt file, for example, the only way to access that
info is from File Properties on the Context menu.

If you send that same .txt file with Comments to a floppy you will get the
Confirm Stream Loss warning. If you zip that same .txt file with Comments
and then send it to a floppy you do not get the Confirm Stream Loss warning,
you just lose the Summary info.

With .txt files the Summary info is stored as an Alternate Data Stream.
With a .doc file the Summary info is stored in the file itself.
---------

NTFS Alternate (Multiple) Data Streams articles

The first four are short and to the point.

NTFS Data Streams - Windows Alternate Data Stream, NP.EXE
http://www.auditmypc.com/freescan/readingroom/ntfsstreams.asp

Windows Alternate Data Streams
http://www.bleepingcomputer.com/forums/tutorial25.html

Windows NTFS Alternate Data Streams
http://www.securityfocus.com/infocus/1822

NTFS Streams
http://www.alcpress.com/articles/ads.html

-----

Alternate Data Streams Threat or Menace Why Alternate Data Streams
http://www.informit.com/articles/article.asp?p=413685&rl=1

FAQ Alternate Data Streams in NTFS
http://www.heysoft.de/nt/ntfs-ads.htm

Fork (filesystem)
http://en.wikipedia.org/wiki/Alternate_data_stream

Hidden NTFS Alternate Data Streams (ADS) Explained - Are You At Risk?
http://www.diamondcs.com.au/web/streams/streams.htm

Hidden Threat Alternate Data Streams
http://www.windowsecurity.com/articles/Alternate_Data_Streams.html

NTFS Alternate Data Streams » Girl Geekette dotNet
http://www.girlgeekette.net/2005/09/16/ntfs-alternate-data-streams/

NTFS Data Streams
http://www.relsoft.net/datastreams.html

NTFS Streams - Everything you need to know (demos and tests included)
http://www.diamondcs.com.au/index.php?page=archive&id=ntfs-streams

Practical Guide to Alternative Data Streams in NTFS
http://www.irongeek.com/i.php?page=security/altds


--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Wesley Vogel]

Any file on an NTFS formatted drive can have ADS, Alternate Data Streams.

On NTFS alternate data streams can be created by using the Summary tab.

[[A data stream is a sequence of bytes. An application populates the stream
by writing data at specific offsets within the stream. The application can
then read the data by reading the same offsets in the read path. Every file
has a main, unnamed stream associated with it, regardless of the file system
used. However, NTFS supports additional named data streams in which each
data stream is an alternate sequence of bytes as illustrated in Figure x.
Applications can create additional named streams and access the streams by
referring to their names. This feature permits related data to be managed as
a single unit. For example, a graphics program can store a thumbnail image
of a bitmap in a named data stream within the NTFS file containing the
image.]]

[[FAT volumes support only the main, unnamed stream, so if you try to copy
or move a file to a FAT volume or floppy disk, you receive an
error message as shown below. If you copy the file, all named data
streams and other attributes not supported by FAT are lost.]]
from...
Multiple Data Streams
http://www.microsoft.com/technet/prodtechnol/winxppro/reskit/c13621675.mspx

Link has changed.

Working with File Systems
http://www.microsoft.com/technet/prodtechnol/winxppro/reskit/c13621675.mspx

Click on...
Using the NTFS File System
and scroll down to...
Multiple Data Streams

Or do a Ctrl + F for Multiple Data Streams.

-----------------------
Confirm Stream Loss
-----------------------
The file 'xxxxxxxxxxxxx.zzz' has extra information
attached to it that might be lost if you continue copying. The
contents of the file will not be affected. Information that might be
lost includes:
Summary Info
Document Summary Info

Do you want to proceed anyway?
-----------------------

Click YES because there is nothing you can do about it.

With a Word .doc you can access Summary info from the File Properties
without opening the file or you can access that info by opening the file,
clicking File and then Properties.

If you add Comments to a .txt file, for example, the only way to access that
info is from File Properties on the Context menu.

If you send that same .txt file with Comments to a floppy you will get the
Confirm Stream Loss warning. If you zip that same .txt file with Comments
and then send it to a floppy you do not get the Confirm Stream Loss warning,
you just lose the Summary info.

With .txt files the Summary info is stored as an Alternate Data Stream.
With a .doc file the Summary info is stored in the file itself.
---------

NTFS Alternate (Multiple) Data Streams articles

The first four are short and to the point.

NTFS Data Streams - Windows Alternate Data Stream, NP.EXE
http://www.auditmypc.com/freescan/readingroom/ntfsstreams.asp

Windows Alternate Data Streams
http://www.bleepingcomputer.com/forums/tutorial25.html

Windows NTFS Alternate Data Streams
http://www.securityfocus.com/infocus/1822

NTFS Streams
http://www.alcpress.com/articles/ads.html

-----

Alternate Data Streams Threat or Menace Why Alternate Data Streams
http://www.informit.com/articles/article.asp?p=413685&rl=1

FAQ Alternate Data Streams in NTFS
http://www.heysoft.de/nt/ntfs-ads.htm

Fork (filesystem)
http://en.wikipedia.org/wiki/Alternate_data_stream

Hidden NTFS Alternate Data Streams (ADS) Explained - Are You At Risk?
http://www.diamondcs.com.au/web/streams/streams.htm

Hidden Threat Alternate Data Streams
http://www.windowsecurity.com/articles/Alternate_Data_Streams.html

NTFS Alternate Data Streams » Girl Geekette dotNet
http://www.girlgeekette.net/2005/09/16/ntfs-alternate-data-streams/

NTFS Data Streams
http://www.relsoft.net/datastreams.html

NTFS Streams - Everything you need to know (demos and tests included)
http://www.diamondcs.com.au/index.php?page=archive&id=ntfs-streams

Practical Guide to Alternative Data Streams in NTFS
http://www.irongeek.com/i.php?page=security/altds

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Tim Slattery]

With a tool I found out that some, but not all (approx 2% of my files) are NTFS
streams instead of normal files.

Not to worry.

What exactly are NTFS streams?

A file in NTFS can be understood as a collection of streams. The file
content that we all see and work with every day is stored in the
default or unnamed stream. But there can be any number of other named
streams in the file.

In Windows Explorer, you can right-click on a *.txt file, select
"Properties", then click the "Summary" tab. There you can put
information about the file: title, subject, author, comments, etc.
This data will be saved in named streams that are attached to the
file. You won't see any trace of them in Windows Explorer, but they'll
be there. When you show the "Summary" tab again, the data will be read
from those streams and displayed for you.

So to have a small percentage of your partition occupied by named
streams is to be expected.

At http://www.heysoft.de you can find a small tool called LADS (List
Alternate Data Streams). This will show the name and size of every
alternate data stream in a specified directory.