The NTFS file system has a little known feature called “Alternate Data Streams”. It can store any kind of data, which will not be visible in Windows Explorer.
Access via default PowerShell Commands is possible:
The most commonly known Alternate Data Stream is
$DATA, which is simply the default data stream containing the actual file contents.
Get-Content 'Filename.ext' is equivalent to
Get-Content 'Filename.ext' -Stream '$DATA'
Windows and browsers use a stream called
Zone.Identifier to display the “Do you want to run this file?” dialog for downloaded files.
The content of the stream looks like this:
After scanning all files on my PC, I only found two other streams,
com.dropbox.attrs - obviously used by the dropbox client.
Alternate Data Streams could be useful in your own applications, to store some metadata. Keep in mind, that they will only work on NTFS volumes. All streams, except
$DATA, will be lost when copied to FAT, EXT or HFS file systems.
- c’t Magazin, Jhg 2019, Nr. 20, S. 158ff, Art “Platzverwalter”
- Was steckt hinter der Sicherheitswarnung nach einem Download, Technet Blogs