NTFS Alternate Data Streams: How Files Hide Inside Other Files

Every file on an NTFS volume has at least one data stream — the unnamed one, which is what you see when you open the file. NTFS also permits additional named streams attached to the same file. Their contents do not appear when the file is opened, do not affect the size shown in Explorer, and survive an ordinary copy within NTFS.

That combination makes alternate data streams a durable hiding place, and knowing they exist is the difference between finding data during an investigation and missing it entirely.

How They Work

The syntax is a colon: filename.txt:hidden refers to a stream named hidden on the file filename.txt. Reading filename.txt returns only the default stream. The named stream is reachable only by asking for it specifically.

Consequences that matter in practice:

• Explorer shows the default stream's size. A one-kilobyte text file can carry a fifty-megabyte alternate stream and still look like a one-kilobyte text file. Disk free space changes; the file's reported size does not.
• Ordinary copy operations preserve them within NTFS. Move the file to FAT32, exFAT or most network shares and the streams are silently dropped. A copy that loses data without an error is itself worth knowing about — it is one more reason file system type matters, as covered in FAT32 and file system comparison.
• Most tools ignore them by default. Directory listings, search indexing and a good deal of scanning software look only at the default stream.

Legitimate Use

Windows uses streams itself, and knowing this prevents a false positive. The most common is Zone.Identifier, which records that a file came from the internet — it is what drives the "this file came from another computer" warning and the Mark of the Web behavior that makes Office refuse to enable macros. Thumbnails and some metadata have historically used streams as well.

So the presence of an alternate stream is not by itself suspicious. An unexpected stream name, or a stream large enough to hold a payload, is.

How They Are Abused

Data concealment. Exfiltration staged inside streams on innocuous files, where a directory review shows nothing unusual.

Executable hiding. A binary or script stored in a stream and launched from there. The file on disk still looks like a document. Some interpreters can be pointed at a stream directly, which keeps the payload off the visible file system.

Persistence. A scheduled task or registry entry referencing a stream path, so the artifact investigators look for is not where the reference points.

Mark of the Web stripping. Deliberately removing Zone.Identifier so a downloaded file is treated as local and its macro restrictions do not apply. This is a real and current technique in phishing delivery.

Streams are a hiding place, not an execution technique in themselves — they pair with in-memory methods such as process hollowing rather than replacing them.

Finding Them

Built-in options work. dir /R lists alternate streams alongside filenames. In PowerShell, Get-Item -Stream * enumerates the streams on a file and Get-Content -Stream reads one. Sysinternals streams.exe walks a tree and can delete what it finds.

Forensic imaging preserves streams because it operates below the file system abstraction, which is one of the reasons a bit-level image is not interchangeable with a file copy — a point covered in forensic acquisition. A copy made by dragging folders loses them.

For detection, EDR is the practical control, since it observes stream creation and reads as behavior rather than trying to catch a static artifact. Periodic enumeration of streams in user-writable directories — temporary folders, download locations, profile directories — is a reasonable hunting exercise, and unexpected results are rare enough to be worth following.

Hiding Versus Encrypting

Worth being clear about: streams provide concealment, not protection. Anyone who knows to look will find the content in plaintext. That places them alongside steganography and obfuscation as security through obscurity — effective against inattention, worthless against a directed search.

Exam Focus

Know that alternate data streams are an NTFS feature and that the colon syntax addresses them. Know they do not appear in Explorer and do not change the displayed file size. Know they are lost when copied to a non-NTFS file system. Know dir /R and PowerShell's -Stream parameter as enumeration methods. And recognize Mark of the Web stripping as the reason an attacker would want to remove a stream rather than add one.