Scribd
Upload
16 views5 pages

Hiding Data with NTFS Streams

The document explains how to use Alternate Data Streams in the NTFS file system to hide data within files in Windows. It details the process of creating, accessing, and managing these hidden streams using command line syntax. While this method is not completely secure, it provides a fun way to store data discreetly within a file.

Uploaded by

tomasjohn010
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
16 views5 pages

Hiding Data with NTFS Streams

The document explains how to use Alternate Data Streams in the NTFS file system to hide data within files in Windows. It details the process of creating, accessing, and managing these hidden streams using command line syntax. While this method is not completely secure, it provides a fun way to store data discreetly within a file.

Uploaded by

tomasjohn010
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd

Here’s how it Works

Ever since Windows 2000, the NTFS file system in Windows has supported Alternate
Data Streams, which allow you to store data “behind” a filename with the use of a stream
name. It’s not detectable while browsing the file system, or anywhere within Windows…
you can only access it with the “secret key” which is really just the name of the stream.

You can think of these extra streams as secret compartments within the file, which can
only be accessed if you know the “secret code”, which in this case is just the name of the
stream.

This isn’t a completely secure way to hide data as we’ll illustrate below, but it’s a fun trick
to know about in a pinch. Note: This only works on a drive formatted with NTFS.

Hiding Data in a Secret Compartment

In order to use this feature, you’ll have to open a command prompt and use the following
syntax:

Notepad [Link]:[Link]
You can use anything after the colon as a secret word, the key is that there can’t be any
spaces between the first filename and the colon.

If you didn’t specify .txt on the end, Notepad will automatically add it, and ask if you want
to create a new file, even if [Link] already existed, because SecretSquirrel!.txt
doesn’t already exist.

Now you can enter in whatever data you want here and save the file:
When you look at the file, it will still be the exact same size as before:

You can even open up the file by double-clicking on it, and add whatever data you want
to make the file look normal:

Note: Once you create a hidden stream, that stream isn’t exactly part of the file… you
can’t copy your file to another location and access the streams over there.
Detecting Files with Streams

If you’re using Windows 7, you can simply use the /R argument to the DIR command to
see the streams:

Adding to Hidden Streams from the Command Line

You can add data to a hidden stream by using a number of commands, or really
anything that can pipe input or output and accept the standard FileName:StreamName
syntax. For instance, we could use the echo command:

Echo “Some More Data!” >> [Link]:[Link]


You can see with the streams command in the example above that we now have a
hidden stream on the file.

Reading a Stream From the Command Line

You can read data from the stream by piping data into the more command, using this
syntax:

More < FileName:StreamName

In my example the actual command was this:

More < [Link]:[Link]

As you can see, the secret data that we added is outputted to the console.

You might also like