Most of you probably already know about hidden files in windows.
It's relatively easy to enable them, you just check a box.
And if you consider yourself a power user, you may even know about protected system files,
which is basically another level of hidden files, but it's just another checkbox.
But there is another way of hiding files in Windows that I would best describe as being
"super hidden" files that I bet very few of you know about.
However, the actual term for them are "alternate data streams".
Not only are these alternate data stream files not visible by default in Windows Explorer,
they actually can't be viewed in Explorer at all.
And sometimes this could even be used maliciously by a virus because it could potentially create
a massive file that takes up almost all the space on your hard drive, but you won't be
able to find it.
And many disk analyzers won't even recognize alternate data stream files unless you specifically
check special settings, if it'll support it at all.
So it's basically impossible to just stumble across these files unless you specifically
are looking for them.
So it's good to at least know about these.
So in this video, we'll go over what these data streams are actually used for legitimately.
How to create them, how to delete them, how to find them, and look at some actual cases
of them being used.
So let's get started right into showing you how this all works so you can know what I'm
even talking about.
So let's take, for example, this file here.
It's just called example.txt.
And in there it just says "hello" and say we want to hide something in it.
Now we can hide just some regular text in there or an entire file, but let's start out
with the text.
So what you do is you open up the command prompt and you use this command in the same
directory as this file.
You do " notepad example.txt" and then a colon and then whatever.
And then "whatever" is any stream name you want.
And the notepad is just saying, what program will be used to open this alternate data stream.
Since we're writing text to it, we're going to use notepad.
So it'll open Notepad, ask if we want to create a file, we say yes.
So we just type in whatever we want, such as "very secret message" and then save it
and close it.
And if we open up the file again, this time it still says hello.
So where did that message go?
Well, if we enable hidden file viewing and even system protected file viewing in Explorer,
it still is nowhere to be found.
So to get it back, we use the same command as before, notepad (or whatever program you
want to open it with), and then example.txt:whatever.
And then it'll open it back up and we see the secret message is there.
Now, there are actually several ways to spot these alternate data streams and find them.
I'll go over in more detail, several of them later, but one of them is to just use the
directory command, the "Dir" command in Command Prompt.
Normally if you use this command, it won't show it.
However, if you'd use the "/r" parameter, so "dir /r", it will actually show the streams.
So there it is.
Example.txt:whatever.
And next to it, it does say data, but that's just an attribute for the type of stream.
I'm not going to go over those.
But still with this, you can see that it is in fact, in here and attached to that text
file.
Next, let's try and hide an entire file inside another file.
So at this time, let's create a text file called imagetest.txt and let's put this image
into it, which is image.jpg.
So the command here we use is "type" and then "image.jpg" and then the "greater than" sign
and then imagetest.txt and then a colon, and then picture.jpg.
Technically, we don't need the "dot jpg" extension for the stream, but it might make it easier
to recognize.
Now what this is doing specifically is the "type" command is a way to output the contents
of any file.
And what we're doing with the greater than sign is simply redirecting that output.
And we're putting it into this data stream.
So it's taking whatever is the contents and data of the image file, and putting it into
this data stream that we're calling picture.jpg in there.
And then you just wait, and the bigger the file, the longer it will take.
And as you can see, interestingly, if you look at the file that we stored the image
into, it still shows zero kilobytes as if it is taking up no space at all.
However, if we go into the properties window of the file, it will actually say that the
"size on disk" is like seven megabytes, which is the file size of the image, even though
the regular size displayed in explorer
and wherever, says zero.
So again, that's one way that you can kind of recognize alternate data streams, is by
looking at the disparity between the actual size and the size on disk.
But we'll go over more ways again later.
Another thing is when you're hiding the file, it gets copied into it, so it will still be
there after you do it.
Now, to get the file out of this, we use a different command called "expand".
So in the command prompt we specifically type in expand and then imagetest.txt:picture.jpg,
whatever you used, and then we can name it whatever we want, such as extract.jpg will
be the output file.
And expand normally is a command that is used to extract files out of a compressed file
like a zip file,
but it works for this too.
So after we run it, it gets copied out and there's the file.
And yes, the stream still is in there.
Again, it's copied out.
A couple additional things I want to point out are you can have multiple data streams
per file, as many as you want.
And also you can actually add alternate data streams to folders, not just files.
So if we have this "ExampleFolder", we can use the same exact method as before with command
prompt, and now if we list the directory, we can see it also has a stream attached to
it.
Now, as for how to delete these alternate data streams, you'll see more examples later,
but there are two easy ways, but are kind of rudimentary.
So one of them is to just delete the original file.
Deleting the original file will also delete any associated data streams.
And also another way is because this alternate data stream feature is a part of the NTFS
file system, and it's not actually part of Windows itself, you can just simply copy the
original file and associated streams onto another file system, such as a USB drive that's
formatted with ExFAT or FAT32, and then it will strip off any alternate data streams
and only copy the original file.
And when you do that, you will notice it says "The file has properties that can't be copied
to the new location", and that's what it means.
Another thing to point out is if you try and go to upload the file to a website or attach
it to an email or something, that will also strip off the alternate data streams and that
won't warn you about doing it.
Now let's go over different ways of finding these alternate data streams.
And if you know, to look for them, they're actually pretty easy to find.
We already saw one way where if you know exactly which file to check, you can just look at
the properties menu and check to see if the size and size on disk are significantly different.
That could be a sign that there's an alternate data stream.
And then I also mentioned how you can use the "dir /r" command in command prompt and
that will list all of them in a particular directory.
Now, if you don't know exactly where an alternate data stream is, either by the file or even
which directory, there are several ways that you can actually seek them out and scan for
them.
One way is to use a disk analyzer, but this is going to vary how this works.
So by this one example, I've mentioned many times, is WinDirStat.
Which basically shows you the file size of all files on your disk as a map.
Though WinDirStat isn't very helpful here because it will only show alternate data streams
as unknown file size.
So it tells you how many are on the disk, but not where at all.
There is another disk analyzer though called WizTree which basically is my new favorite
in my opinion.
And it's basically like WinDirStat except newer and faster.
I mean, WinDirStat hasn't been updated since 2007, for God's sake.
So in WizTree at least, there is a separate column for allocated size, which again includes
alternate streams, similar to how the "size on disk" thing is in the properties window.
And also you can enable it to show the alternate data streams in the graphical display.
So if you do "Options > Show Allocated Size On Tree Map", in that case, you'll still be
able to at least recognize which file is taking up so much space if there is an alternate
data stream for it, even if it doesn't look like that in Explorer.
However, there is another specialized tool for alternate data streams called Alternate
Stream View.
This is a program from NirSoft, which is basically one guy who writes a whole bunch of very popular,
very well known, extremely useful tools on his website.
I think he's got like hundreds of them, and one of them is for viewing alternate data
streams it can scan for them.
So you can set the option to scan wherever or even an entire drive, though it will take
a very long time if you're scanning an entire drive, but it will at least find them all,
and you can hit the stop button at any time to stop where it is.
And then after it finishes or you stop it, it'll show you a bunch of information, like
the name of the stream, the location, the size of it.
And you can also sort by any of these columns too.
Then you can right click on any of these.
And there's several options.
For example, you can export the stream, like we did before using the expand command, except
here there's no command line, it's just a right click button.
You can also delete the stream.
There is an option to open the stream with a program, but apparently that has not worked
since Windows 7.
So to actually see the stream contents, you need to extract it first.
You can even create an HTML report for all the data streams if you want to create basically
a log file and save them for later.
And yes, it will also show data streams for folders like I talked about before.
So this is definitely a tool to know about if you're looking for these.
All right next up, let's take a look at some actual legitimate uses for alternate data
streams that is used by Windows specifically.
So if you looked through this list that I was showing, you probably noticed one pretty
common called Zone Identifier.
And this is going to show up on any file basically, that's been downloaded from the Internet.
And the reason for this is it basically is kind of like a metadata tag to tell the computer,
"hey, this came from the Internet.
You might want to be a little more cautious with it".
And this is also known as "Mark of the Web".
So if you're looking up info about this, that's something to search for.
If we look in one of these zone identifier streams, we can see there are a few different
entries.
One is ReferrerUrl and this is the page that it was downloaded from.
And then the HostUrl is the actual file URL.
The next one is Zone ID, which basically says the level of trust for this downloaded file
based on where it came from.
Zone ID zero means it came from the local machine.
Zone ID one means it came from the local intranet, so like a local network.
Two means it came from a trusted site.
Three means it came from just the general Internet, not a trusted site.
And then four means it came from a restricted site.
And by the way, these are actually the same exact levels of trust that you may have at
some point seen in the Internet Explorer Security Options levels.
So it's the same ones here, they're just in number form.
An actual example of this being used is sometimes if you download an exe file off the Internet,
Windows will warn you that it might not be signed or something like that.
And that's specifically, if the file is marked with zone three from the Internet.
But also, usually it's only going to warn you if there are other criteria that are fulfilled,
like again, it's not signed by a root authority for the certificate or something like that.
And for these files what you do is you go into the properties window and then you check
the box "Unblock".
And what that does is actually deletes this alternate data stream and deletes out the
Zone Identifier.
So then it will no-longer warn you after you run it the next time.
So that's how that works.
And also, fun fact, if you change the zone ID number to four, restricted sites, it won't
even warn you.
It'll just not let you run the file at all, so that's just a fun fact.
I also noticed that many files that were downloaded have a stream called SmartScreen, which is
Microsoft SmartScreen, their antivirus detection thing.
But when I looked in that stream, it literally just has the text "Anaheim".
So that must be code for something, I'm not sure what it is, but it's just kind of interesting.
Finally, you might be wondering why these alternate data streams are even a thing, they
don't seem to be used for much.
And the reason was actually originally for compatibility with the file systems used by
Macs.
If you watched my previous video where I talked about that weird "__MacOSX" folder that you
may see come out of zip file sometimes if it was made on a Mac, this will make a lot
more sense.
So that video, I go way more in detail about this.
However, the basics is that on the Mac file system, there are the regular files, and then
each file is actually made up of two things behind the scenes called Forks.
One is a data fork which contains like the actual data of the file, and the other is
a resource fork, which usually these days just contains some metadata, but before it
was used for a lot more stuff.
So to add compatibility between a Mac file that was copied off a Mac and onto a Windows
computer, that may have this information behind the scenes in a resource fork,
well NTFS added this feature called Streams, which would basically do the exact same thing.
So it could kind of hide information that might be necessary for file behind the scenes.
And then the regular file would just be visible.
Again though, these days, even on Macs these forks are not really used for much other than
metadata, same as on NTFS.
So they're not really used for much in either case, too much anymore.
If you do want to learn more, though definitely check out that video I mentioned talking about
that Mac OS X folder, I go to a lot more detail about some other stuff too that you should
find interesting.
If you guys want to subscribe, definitely do that and enable the bell.
I make videos about twice a week.
So you don't want those getting lost in the rest of your subscriptions.
And also be sure to like the video comment.
Let me know what you think down in the comment section.
So thanks so much for watching, guys, and I'll see you in the next video.