By Mark Russinovich

Published: July 4, 2016

Download Streams(499 KB)

Introduction

The NTFS file system provides applications the ability to createalternate data streams of information. By default, all data is stored ina file's main unnamed data stream, but by using the syntax'file:stream', you are able to read and write to alternates. Not allapplications are written to access alternate streams, but you candemonstrate streams very simply. First, change to a directory on a NTFSdrive from within a command prompt. Next, type 'echo hello >test:stream'. You've just created a stream named 'stream' that isassociated with the file 'test'. Note that when you look at the size oftest it is reported as 0, and the file looks empty when opened in anytext editor. To see your stream enter 'more < test:stream' (the typecommand doesn't accept stream syntax so you have to use more).

NT does not come with any tools that let you see which NTFS files havestreams associated with them, so I've written one myself. Streams willexamine the files and directories (note that directories can also havealternate data streams) you specify and inform you of the name and sizesof any named streams it encounters within those files. Streams makes useof an undocumented native function for retrieving file streaminformation.

Using Streams

Usage: streams [-s] [-d] <file or directory>

Download Streams(499 KB)

Runs on:

• Client: Windows Vista and higher
• Server: Windows Server 2008 and higher
• Nano Server: 2016 and higher