"VanguardLH" wrote in message
"VanguardLH" wrote ...
In addition, Windows Explorer will never show you the size of Alternate
Data Streams (ADS) added to a file. For example, I can create a .txt
file whose primary data stream chews up only, say 5KB but then add an
alternate data stream that is gigabytes in size. Windows Explorer,
'dir', and other normal file utilities will only show you the size of
the primary data stream.
I found a better utility for scanning for ADS: NirSoft
AlternateStreamView. Strangely, this utility does not agree on all of the
results with the ADS Scanner you mentioned.
Some surprising things I found:
1) Dropbox is using the ADS feature actively, and many dropbox files have up
to 4096 bytes of ADS information attached to them.
2) The AlternateStreamView shows an additional field of
"StreamAllocatedSize". In my boot partition I had a few files where the
actual ADS stream was about 1K but the ADS Allocated Size was about 65K.
Does anyone know if the "allocated size" represents actual disk space in
Most of these files that AlternateStreamView reported large allocation sizes
on were not even seen by ADS Scanner.