http://blogs.msdn.com/bwaldron/archive/2004/05/12/130240.aspxI have always found NTFS Alternate Data Streams interesting. It is an easy way to hide metadata from users. I wrote a utility called ADSFile as a .NET Wrapper for the Win32 API calls. Someone asked for me to provide the ability to enumerate data streamsen-USCommunityServer 2.1 SP1 (Build: 61025.2)http://blogs.msdn.com/bwaldron/archive/2004/05/12/130240.aspx#130376Wed, 12 May 2004 12:54:00 GMT91d46819-8472-40ad-a661-2c78acb4018c:130376Sergey SimakovMark Russinovich utility streams (<a target="_new" href="http://www.sysinternals.com/ntw2k/source/misc.shtml#streams">http://www.sysinternals.com/ntw2k/source/misc.shtml#streams</a>) also enumerates alt streams but using low-level NtQueryInformationFilehttp://blogs.msdn.com/bwaldron/archive/2004/05/12/130240.aspx#207844Wed, 04 Aug 2004 14:49:00 GMT91d46819-8472-40ad-a661-2c78acb4018c:207844H. CarveyI have a paper on ADSs available here: <br><a target="_new" href="http://patriot.net/~carvdawg/docs/dark_side.html">http://patriot.net/~carvdawg/docs/dark_side.html</a> <br> <br>For more information, check out my book here: <br><a target="_new" href="http://www.windows-ir.com">http://www.windows-ir.com</a>http://blogs.msdn.com/bwaldron/archive/2004/05/12/130240.aspx#9660377Sat, 30 May 2009 02:13:50 GMT91d46819-8472-40ad-a661-2c78acb4018c:9660377 Ben Waldron NTFS Alternate Data Streams | Paid Surveys<p>PingBack from <a rel="nofollow" target="_new" href="http://paidsurveyshub.info/story.php?title=ben-waldron-ntfs-alternate-data-streams">http://paidsurveyshub.info/story.php?title=ben-waldron-ntfs-alternate-data-streams</a></p>