thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Alternate Data Stream (ADS)

An NTFS feature allowing additional data streams to be attached to a file, which can hide data or malicious code.

Definition

ADS content does not change the visible file size in Explorer and can store executables or scripts. Windows uses the Zone.Identifier ADS for Mark of the Web. dir /r and Get-Item -Stream * reveal streams.

Example

type evil.exe > notes.txt:hidden.exe hides an executable in an ADS.

Exam tip

ADS is an NTFS-only hiding technique; dir /r reveals it.

Related terms