AlternateStreamView 1.15
|
Date Added: |
Jul 23, 2010 11:48 AM |
Publisher's Description: |
AlternateStreamView is a small utility that allows you to scan your NTFS drive, and find all hidden alternate streams stored in the file system. After scanning and finding the alternate streams, you can extract these streams into the specified folder, delete unwanted streams, or save the streams list into text/html/csv/xml file.
System Requirements
This utility works on any version of Windows starting from Windows 2000 and up to Windows 7.
Versions History
Version 1.15:
Added command-line support.
Fixed issue: Removed the wrong encoding from the xml string, which caused problems to some xml viewers.
Version 1.12:
Fixed the problem with icons on Windows 7/x64 systems.
Version 1.11:
Added 'Explorer Copy' option - copy selected files and then paste them into Explorer window.
Version 1.10:
Added support for choosing the folder depth of subfolders scanning.
Version 1.05:
Fixed bug: In Windows Vista, NTFS junction point to 'Application Data' folder created a recursive scan. In this version, AlternateStreamView automatically skip junction points.
Fixed bug: AlternateStreamView failed to delete streams of read-only files.
Fixed bug: AlternateStreamView allowed to close the main window during scan.
Version 1.00 - First release.
About Alternate Streams in NTFS File System
NTFS system has a feature that allows to add multiple streams in addition to the main file stream. When you open or view the file, only the main file stream is visible, while other additional streams are hidden from the user.
Here's 3 examples of alternate streams usage in Windows operating system:
Favorites of Internet Explorer: When You add a Web site link into your 'Favorites', a .url file containing the url and description is created. However, if the Web site also have an icon (favicon), the icon is saved as alternate stream for the same url file. The stream name of the icon is :favicon:$DATA
Downloaded files of Internet Explorer: When you download and save a file with Internet Explorer, it automatically add a zone information for the saved file. This zone information is used for identifying the file as downloaded file from the Internet. The stream name in this case is :Zone.Identifier:$DATA
Summary information of files: When you right-click on a file in Explorer and go to the 'Summary' tab, you can add summary information for the file, like title, subject, author, and so on. This summary information is also saved into alternate stream. The stream name in this case is SummaryInformation:$DATA.
In addition to the legitimate usage of alternate streams, this technique may also be used by Viruses/Trojans/Spywares for saving data and hiding it from the user.
Using AlternateStreamView
AlternateStreamView doesn't require any installation process or additional DLL files. In order to start using it, simply run the executable file - AlternateStreamView.exe
After running it, choose the drive or folder that you wish to scan, and click Ok. AlternateStreamView will scan the selected folder, and then it'll display all alternate streams found in the selected drive/folder. After the scan is finished, you can select one or more alternate streams, and then delete them ('Delete Selected Streams' option), or copy them into a folder that you choose ('Export Selected Streams To...').
|
Screenshot: |
|
Documentation: |
http://www.nirsoft.net/utils/alternate_data_streams.html |
Last Download: |
May 01, 2024 10:27 AM
|
Downloads: |
282 |
OS: |
Windows |
Rating: |
|
|
|