![]() |
If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below. |
|
|
Thread Tools | Display Modes |
#11
|
|||
|
|||
![]()
W wrote:
"VanguardLH" wrote in message ... "VanguardLH" wrote ... In addition, Windows Explorer will never show you the size of Alternate Data Streams (ADS) added to a file. For example, I can create a .txt file whose primary data stream chews up only, say 5KB but then add an alternate data stream that is gigabytes in size. Windows Explorer, 'dir', and other normal file utilities will only show you the size of the primary data stream. http://en.wikipedia.org/wiki/Alterna...ream#Microsoft http://www.symantec.com/connect/arti...e-data-streams I found a better utility for scanning for ADS: NirSoft AlternateStreamView. Strangely, this utility does not agree on all of the results with the ADS Scanner you mentioned. Some surprising things I found: 1) Dropbox is using the ADS feature actively, and many dropbox files have up to 4096 bytes of ADS information attached to them. 2) The AlternateStreamView shows an additional field of "StreamAllocatedSize". In my boot partition I had a few files where the actual ADS stream was about 1K but the ADS Allocated Size was about 65K. Does anyone know if the "allocated size" represents actual disk space in use? Most of these files that AlternateStreamView reported large allocation sizes on were not even seen by ADS Scanner. Amazingly, it notes that concept here. That StreamAllocatedSize is set aside for the stream for some reason. I don't know if this idea is intended for sparse storage, or what they were thinking. You would have thought, if they were going to waste space, they'd round to the nearest 4K or whatever. http://msdn.microsoft.com/en-us/libr...(v=vs.85).aspx For a stream to work, it would have to have a provision for extending the storage space later (leading to fragmentation). Pre-allocating a space, isn't of much use if you don't "guess right" on the size to set aside. So I'm missing what the big gain is, in having such a feature. Paul |
Thread Tools | |
Display Modes | |
|
|