DOCSLIB.ORG

Untersuchungen Am Dateisystem HFS Plus

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Untersuchungen Am Dateisystem HFS Plus Technische Berichte in Digitaler Forensik Herausgegeben vom Lehrstuhl für Informatik 1 der Friedrich-Alexander-Universität Erlangen-Nürnberg (FAU) in Kooperation mit dem Masterstudiengang Digitale Forensik (Hochschule Albstadt-Sigmaringen, FAU, Goethe-Universität Frankfurt am Main) Untersuchungen am Dateisystem HFS Plus Lars Mechler 22.03.2016 Technischer Bericht Nr. 7 Zusammenfassung Dieser Bericht enthält eine Analyse des Dateisystems HFS Plus unter Verwendung des Referenzmodells aus dem Buch "File System Forensik Analysis" von Brian Carrier. Die Dateisystemstrukturen von HFS Plus, die für die forensische Analyse bedeutsam sind, werden unter Einordnung in die Datenkategorien von Carrier detailliert behandelt. Anschließend wird für jede Kategorie ein Analyseszenario mitsamt den erforderlichen Analysetechniken vorgestellt. Entstanden als Masterarbeit im Rahmen des Studiengangs Digitale Forensik unter der Betreuung von Felix Freiling und Victor Völzow. Hinweis: Technische Berichte in Digitaler Forensik werden herausgegeben vom Lehrstuhl für Informatik 1 der Friedrich-Alexander-Universität Erlangen-Nürnberg (FAU) in Kooperation mit dem Masterstudiengang Digitale Forensik (Hochschule Albstadt-Sigmaringen, FAU, Goethe- Universität Frankfurt am Main). Die Reihe bietet ein Forum für die schnelle Publikation von Forschungsergebnissen in Digitaler Forensik in deutscher Sprache. Die in den Dokumenten enthaltenen Erkenntnisse sind nach bestem Wissen entwickelt und dargestellt. Eine Haftung für die Korrektheit und Verwendbarkeit der Resultate kann jedoch weder von den Autoren noch von den Herausgebern übernommen werden. Alle Rechte verbleiben beim Autor. Einen Überblick über die bisher erschienenen Berichte sowie Informationen zur Publikation neuer Berichte finden sich unter https://www1.cs.fau.de/df-whitepapers. II Inhaltsverzeichnis Inhaltsverzeichnis ..................................................................................................................... III Abkürzungsverzeichnis ............................................................................................................. VI Abbildungsverzeichnis ............................................................................................................. VII Tabellenverzeichnis .................................................................................................................. IX 1. Einleitung ........................................................................................................................... 1 1.1 Zielsetzung .................................................................................................................. 1 1.2 Abgrenzung ................................................................................................................. 1 1.3 Vorgehensweise .......................................................................................................... 1 1.4 Stand der Technik ....................................................................................................... 3 2. Begriffsdefinitionen ........................................................................................................... 6 2.1 Datenanalyse .............................................................................................................. 6 2.2 Datenträgeranalyse .................................................................................................... 6 2.3 Dateisystemanalyse .................................................................................................... 6 3. Datenträgeranalyse ............................................................................................................ 8 3.1 Partitionsschemen ...................................................................................................... 9 3.1.1 Master Boot Record ............................................................................................ 9 3.1.2 Apple Partitionen ................................................................................................ 9 3.1.3 GPT Partitionen ................................................................................................. 12 3.1.4 Analysemöglichkeiten ....................................................................................... 15 4. Dateisystemanalyse nach dem Kategorienmodell von Carrier ........................................ 18 4.1 Kategorie Dateisystem .............................................................................................. 20 4.2 Kategorie Inhalt ........................................................................................................ 20 4.2.1 Analysetechniken .............................................................................................. 22 4.2.2 Löschtechniken .................................................................................................. 23 4.3 Kategorie Metadaten ................................................................................................ 23 4.3.1 Logische Dateiadressen ..................................................................................... 23 4.3.2 Slack Space ........................................................................................................ 23 4.3.3 Metadatenbasierte Dateiwiederherstellung ..................................................... 24 4.3.4 Analysetechniken .............................................................................................. 24 4.3.5 Löschtechniken .................................................................................................. 26 4.4 Kategorie Dateinamen .............................................................................................. 27 4.4.1 Dateinamenbasierte Wiederherstellung von Dateien ....................................... 27 III 4.4.2 Analysetechniken .............................................................................................. 27 4.5 Kategorie Anwendung .............................................................................................. 28 4.5.1 Dateisystem Journale ........................................................................................ 29 5. Analyse des HFS Plus Dateisystems anhand des Kategorienmodells von Carrier ............ 30 5.1 Kategorie Dateisystem .............................................................................................. 32 5.1.1 Volume Header .................................................................................................. 32 5.1.2 HFS Wrapper ..................................................................................................... 37 5.1.3 Reservierte Bereiche ......................................................................................... 39 5.1.4 Extents ............................................................................................................... 39 5.1.5 File Forks und Double Files ................................................................................ 39 5.1.6 Special Files ....................................................................................................... 42 5.1.7 Zugriffsrechte .................................................................................................... 42 5.2 Kategorie Inhalt ........................................................................................................ 43 5.2.1 Allokationsrhythmus ......................................................................................... 45 5.2.2 Analyse-Szenario ............................................................................................... 45 5.2.3 Analysetechniken .............................................................................................. 46 5.3 Kategorie Metadaten ................................................................................................ 48 5.3.1 B-Tree-Struktur .................................................................................................. 48 5.3.2 Catalog File ........................................................................................................ 53 5.3.3 Extents Overflow File ......................................................................................... 67 5.3.4 Attributes File .................................................................................................... 73 5.3.5 Analysetechniken .............................................................................................. 80 5.3.6 Besonderheiten bei der Analyse von HFS Plus Dateikomprimierung ................ 83 5.4 Kategorie Dateinamen .............................................................................................. 87 5.4.1 Links ................................................................................................................... 88 5.4.2 Analyse-Szenario ............................................................................................... 89 5.4.3 Analysetechniken .............................................................................................. 89 5.5 Kategorie Anwendung .............................................................................................. 94 5.5.1 Journal ............................................................................................................... 94 5.5.2 File Event Store Database ................................................................................ 106 5.6 „The Big Picture“ ....................................................................................................
Load more

Recommended publications
  • Cygwin User's Guide
    Cygwin User’s Guide Cygwin User’s Guide ii Copyright © Cygwin authors Permission is granted to make and distribute verbatim copies of this documentation provided the copyright notice and this per- mission notice are preserved on all copies. Permission is granted to copy and distribute modified versions of this documentation under the conditions for verbatim copying, provided that the entire resulting derived work is distributed under the terms of a permission notice identical to this one. Permission is granted to copy and distribute translations of this documentation into another language, under the above conditions for modified versions, except that this permission notice may be stated in a translation approved by the Free Software Foundation. Cygwin User’s Guide iii Contents 1 Cygwin Overview 1 1.1 What is it? . .1 1.2 Quick Start Guide for those more experienced with Windows . .1 1.3 Quick Start Guide for those more experienced with UNIX . .1 1.4 Are the Cygwin tools free software? . .2 1.5 A brief history of the Cygwin project . .2 1.6 Highlights of Cygwin Functionality . .3 1.6.1 Introduction . .3 1.6.2 Permissions and Security . .3 1.6.3 File Access . .3 1.6.4 Text Mode vs. Binary Mode . .4 1.6.5 ANSI C Library . .4 1.6.6 Process Creation . .5 1.6.6.1 Problems with process creation . .5 1.6.7 Signals . .6 1.6.8 Sockets . .6 1.6.9 Select . .7 1.7 What’s new and what changed in Cygwin . .7 1.7.1 What’s new and what changed in 3.2 .
    [Show full text]
  • 11.7 the Windows 2000 File System
    830 CASE STUDY 2: WINDOWS 2000 CHAP. 11 11.7 THE WINDOWS 2000 FILE SYSTEM Windows 2000 supports several file systems, the most important of which are FAT-16, FAT-32, and NTFS (NT File System). FAT-16 is the old MS-DOS file system. It uses 16-bit disk addresses, which limits it to disk partitions no larger than 2 GB. FAT-32 uses 32-bit disk addresses and supports disk partitions up to 2 TB. NTFS is a new file system developed specifically for Windows NT and car- ried over to Windows 2000. It uses 64-bit disk addresses and can (theoretically) support disk partitions up to 264 bytes, although other considerations limit it to smaller sizes. Windows 2000 also supports read-only file systems for CD-ROMs and DVDs. It is possible (even common) to have the same running system have access to multiple file system types available at the same time. In this chapter we will treat the NTFS file system because it is a modern file system unencumbered by the need to be fully compatible with the MS-DOS file system, which was based on the CP/M file system designed for 8-inch floppy disks more than 20 years ago. Times have changed and 8-inch floppy disks are not quite state of the art any more. Neither are their file systems. Also, NTFS differs both in user interface and implementation in a number of ways from the UNIX file system, which makes it a good second example to study. NTFS is a large and complex system and space limitations prevent us from covering all of its features, but the material presented below should give a reasonable impression of it.
    [Show full text]
  • Onetouch 4 Lite USB Mac User Guide
    Contents Getting Started . .1 Using the Formatting Tool . .1 Preparing the Software Manually . .4 Installing the Software . .9 Managing Your Drives . .15 Customizing the OneTouch Button . .15 Running Diagnostics . .18 Updating Your Software . .19 Backing Up & Restoring Folders . .22 Creating Backup Plans . .22 Using Simple Backup . .22 Creating a Custom Backup Plan . .26 Managing Backup Plans . .33 Editing Backup Settings . .33 Deleting Backup Plans . .36 Backing Up Manually . .37 Restoring Files . .39 OneTouch II and III Users . .42 Managing Security . .42 Using DrivePass . .42 Enabling DrivePass . 42 Unlocking Your OneTouch Drive . 45 Removing DrivePass . 50 Changing Your DrivePass Password . 52 If You Forget Your Password... .55 Synchronizing Folders . .60 Using Pre-configured Sync . .61 Using Custom Sync . .61 Completing the Sync . .64 Maxtor OneTouch IV i Removing Folders from Sync . .65 Checking Sync Status . .65 Synchronizing Manually . .66 Using the Maxtor Synchronization Window . .66 Using Automatic Overwrite . 68 Using RAID . .68 Frequently Asked Questions . .76 Index . i 072407 Maxtor OneTouch IV ii Getting Started The Maxtor OneTouch 4 drive offers these features: • Backup & Restore to protect your data • A customized OneTouch button to quickly open a frequently-used program If you are a OneTouch II or III user, you also have access to features available on that drive: • Sync to synchronize one or more folders between two or more computers • Security settings to password-protect your drive The Maxtor OneTouch software is loaded on your OneTouch drive. Because the software is configured for a Windows operating system, the software must be prepared for installation on your Macintosh. Using the Formatting Tool The Mac OneTouch 4 Formatting tool automatically prepares the Maxtor Manager software for installation on your Macintosh, To use the Mac OneTouch 4 Formatting Tool, Step 1: Connect your OneTouch 4 drive to your computer.
    [Show full text]
  • Partitioner Och Filsystem 2
    Partitioner och filsystem 2 File systems FAT Unix-like NTFS Vad är ett filsystem? • Datorer behöver en metod för att lagra och hämta data… • Referensmodell för filsystem (Carrier) – Filsystem kategori • Layout och storleksinformation – Innehålls kategori • Kluster och block – data enheter – Metadata kategori • Tidsinformation, storlek, access kontroll • Adresser till allokerade data enheter – Filnamn kategori • Oftast ihop-kopplad med metadata – Applikations kategori • Quota • Journaler • De modernaste påminner mycket om relations databaser Windows • NTFS (New Technology File System) – 6 versioner finns, de nyaste är v3.0 (Windows 2000) och v3.1 (XP, 2003, Vista, 2008, 7), kallas även 5.0, 5.1, 5.2, 6.0 och 6.1 (efter OS version) – Stöd för unicode, säkerhet, mm. - är mycket mer komplext än FAT! – http://en.wikipedia.org/wiki/Ntfs • FAT 12/16/32, VFAT (långa filnamn i Win95) – Används fortfarande men är inte effektivt för större lagringskapaciteter (klusterstorleken) – Långsammare access än NTFS • Windows Future Storage (WinFS) inställt projekt, enligt rykten var det en SQL-databas som ligger ovanpå ett NTFS filsystem – Läs mer på: http://www.ntfs.com/ – Och: http://en.wikipedia.org/wiki/WinFS FAT12, 16 och 32 • FAT12, finns på floppy diskar – Begränsad lagringskapacitet – Designat för MS-DOS 1.0 • FAT16, var designat för större diskar – Äldre OS använde detta • MS-DOS 3.0, Win95 OSR1, NT 3.5 och NT 4.0 – Max diskstorlek 2 GB • FAT32 kom när diskar större än 2GB kom – Vissa äldre och alla nya OS kan använda FAT32 • Windows 98/Me/2000/XP/2003/Vista/7 och 2008 • Begränsningar med FAT32 – Största formaterabara volymen är 32GB (större volymer kan dock användas, < 16 TiB) – Begränsade features vad gäller komprimering, kryptering, säkerhet och hastighet jämfört mot NTFS • http://en.wikipedia.org/wiki/FAT_file_system exFAT • exFAT (Extended File Allocation Table, a.k.a.
    [Show full text]
  • ® Apple® A/UXTM Release Notes Version 1.0 Ii APPLE COMPUTER, INC
    .® Apple® A/UXTM Release Notes Version 1.0 Ii APPLE COMPUTER, INC. UNIBUS, VAX, VMS, and VT100 are trademarks of Digital © Apple Computer, Inc., 1986 Equipment Corporation. 20525 Mariani Ave. Cupertino, California 95014 Simultaneously published in the (408) 996-1010 United States and Canada. Apple, the Apple logo, APPLE'S SYSTEM V AppleTalk, ImageWriter, IMPLEMENTATION A/UX LaserWriter, Macintosh, RELEASE 1.0 RUNNING ON A MacTerminal, and ProDOS are MACINTOSH II COMPUTER registered trademarks of Apple HAS BEEN TESTED BY THE Computer, Inc. AT&T-IS' SYSTEM V VERIFICATION SUITE AND Apple Desktop Bus, A!UX, CONFORMS TO ISSUE 2 OF EtherTalk, and Finder are AT&T-IS' SYSTEM V trademarks of Apple Computer, INTERFACE DEFINITION Inc. BASE PLUS KERNEL Ethernet is a registered EXTENSIONS. trademark of Xerox Corporation. IBM is a registered trademark, and PC-DOS is a trademark, of International Business Machines, Inc. - ITC Avant Garde Gothic, ITC Garamond, and ITC Zapf Dingbats are registered trademarks of International Typeface Corporation. Microsoft and MS-DOS are registered trademarks of Microsoft Corporation. NFS is a registered trademark, and Sun Microsystems is a trademark, of Sun Microsystems, Inc. NuBus is a trademark of Texas Instruments. POSTSCRIPT is a registered trademark, and TRANSCRIPT is a trademark, of Adobe Systems Incorporated. UNIX is a registered trademark of AT&T Information Systems. Introduction to A/UX Release Notes, Version 1.0 These release notes contain late-breaking information about release 1.0 of the A!UXI'M software for the Apple® Macintosh® II computer. This package contains two kinds of materials: o Specific information that was not available in time to be incorporated into the printed manuals.
    [Show full text]
  • Filesystems HOWTO Filesystems HOWTO Table of Contents Filesystems HOWTO
    Filesystems HOWTO Filesystems HOWTO Table of Contents Filesystems HOWTO..........................................................................................................................................1 Martin Hinner < [email protected]>, http://martin.hinner.info............................................................1 1. Introduction..........................................................................................................................................1 2. Volumes...............................................................................................................................................1 3. DOS FAT 12/16/32, VFAT.................................................................................................................2 4. High Performance FileSystem (HPFS)................................................................................................2 5. New Technology FileSystem (NTFS).................................................................................................2 6. Extended filesystems (Ext, Ext2, Ext3)...............................................................................................2 7. Macintosh Hierarchical Filesystem − HFS..........................................................................................3 8. ISO 9660 − CD−ROM filesystem.......................................................................................................3 9. Other filesystems.................................................................................................................................3
    [Show full text]
  • Secure Untrusted Data Repository (SUNDR)
    Secure Untrusted Data Repository (SUNDR) Jinyuan Li, Maxwell Krohn,∗ David Mazieres,` and Dennis Shasha NYU Department of Computer Science Abstract for over 20,000 different software packages. Many of these packages are bundled with various operating sys- SUNDR is a network file system designed to store data tem distributions, often without a meaningful audit. By securely on untrusted servers. SUNDR lets clients de- compromising sourceforge, an attacker can therefore in- tect any attempts at unauthorized file modification by troduce subtle vulnerabilities in software that may even- malicious server operators or users. SUNDR’s protocol tually run on thousands or even millions of machines. achieves a property called fork consistency, which guar- Such concerns are no mere academic exercise. For ex- antees that clients can detect any integrity or consistency ample, the Debian GNU/Linux development cluster was failures as long as they see each other’s file modifications. compromised in 2003 [2]. An unauthorized attacker used An implementation is described that performs compara- a sniffed password and a kernel vulnerability to gain su- bly with NFS (sometimes better and sometimes worse), peruser access to Debian’s primary CVS and Web servers. while offering significantly stronger security. After detecting the break-in, administrators were forced to freeze development for several days, as they employed manual and ad-hoc sanity checks to assess the extent of 1 Introduction the damage. Similar attacks have also succeeded against Apache [1], Gnome [32], and other popular projects. SUNDR is a network file system that addresses a long- Rather than hope for invulnerable servers, we have de- standing tension between data integrity and accessibility.
    [Show full text]
  • File Systems Performance Analysis
    File Systems Performance Analysis Benchmarking project for the lecture Computer Performance Analysing And Benchmarking lectured by Prof. Thomas M. Stricker at Swiss Federal Institute of Technology Written by Stefan Rondinelli File Systems Performance Analysis Project CONTENTS 0 Introduction 2 1 The Environment 2 1.1 The Hardware 2 1.2 The Software 3 2 Performing the Benchmark 4 2.1 The Proceeding 4 2.2 The Output 5 3 Statistical Analysis of the Data 6 3.1 Computation of Effects 6 3.2 Confidence Intervals 7 3.3 Are the File Systems Significantly Different? 8 4 References 10 - 1 - File Systems Performance Analysis Project 0 Introduction Every operating system has its own file systems. For example Windows uses FAT16(File Allocation Table 16(bits)), FAT32(File Allocation Table 32) and NTFS(Windows NT File System), Linux uses Minix fs, Extended fs and ext2 and a Mac has its (discarded) MFS(Macintosh file system) and HFS(Hierarchical File System) file systems. Sometimes file systems of other operating systems are supported what for example is desired in a dual boot system (e.g. Linux and Windows). When using such a dual boot machine with Linux and Windows, the performance of a file system could be one of the considerations when choosing what file systems to use for the different partitions. In this project I am going to benchmark some file systems and finally to analyze the gathered data statistically as learned in the lecture. 1 The Environment 1.1 The Hardware I used the following hardware for the performance analysis: - CPU: AMD K6II 450Mhz (has a 64kB cache) - RAM: 64MB SDRAM - Hard disk 1: Western Digital Caviar 36400 (6 GB) - Hard disk 2: Western Digital Caviar 33200 (3 GB) - Disk controller: IDE for both hard disks To have the same conditions these components affecting the I/O speed must be the same ones for all the measurements of the performance of the different file systems otherwise the differences in the measured data would rather be due to unequal hardware then to the different implementation of a file system.
    [Show full text]
  • Apple File System Reference
    Apple File System Reference Developer Contents About Apple File System 7 General-Purpose Types 9 paddr_t .................................................. 9 prange_t ................................................. 9 uuid_t ................................................... 9 Objects 10 obj_phys_t ................................................ 10 Supporting Data Types ........................................... 11 Object Identifier Constants ......................................... 12 Object Type Masks ............................................. 13 Object Types ................................................ 14 Object Type Flags .............................................. 20 EFI Jumpstart 22 Booting from an Apple File System Partition ................................. 22 nx_efi_jumpstart_t ........................................... 24 Partition UUIDs ............................................... 25 Container 26 Mounting an Apple File System Partition ................................... 26 nx_superblock_t ............................................. 27 Container Flags ............................................... 36 Optional Container Feature Flags ...................................... 37 Read-Only Compatible Container Feature Flags ............................... 38 Incompatible Container Feature Flags .................................... 38 Block and Container Sizes .......................................... 39 nx_counter_id_t ............................................. 39 checkpoint_mapping_t ........................................
    [Show full text]
  • Sharing Mac® Files on Windows® Servers a Technical Best Practices Whitepaper
    WHITE PAPER The Best of Both Worlds: Sharing Mac® Files on Windows® Servers A Technical Best Practices Whitepaper About This Document Apple’s® Mac® OS X computer platform has seen its market share grow rapidly in Enterprise environments recently. This has been driven by the popularity of innovative products like the iPhone® and the MacBook Air, as well as Mac OS X’s security and its ability to run virtualized instances of Windows® applications. As a result, Macs are entering the Enterprise through senior level executives or formal corporate pilot projects. Laura DiDio from industry consultancy Information Technology Intelligence Corporation released a survey in late 2008 that showed 68% of some 700 companies polled planned to allow their end-users to deploy Macs as their work systems in the next 12 months. Separately, a recent survey by the Enterprise Desktop Alliance showed that 91% of IT administrators indicated that integration and management parity between Macs and PCs were major issues of importance to their organization. This whitepaper discusses the issues involved in sharing files between Macs and Windows servers and compares the options for successful integration. It is intended for systems administrators, technical evaluators and decision-makers who are considering upgrading or purchasing GroupLogic’s ExtremeZ-IP® solution for the first time. Overview While Apple’s Xserve provides a pure Mac file server solution, most organizations use Windows file servers. Additionally, the official Xserve end-of-life was declared by Apple in January 2011 and Apple no longer offers a server-grade, rack- mountable hardware solution. Existing investments in Windows technology and training, heavy usage, a high volume of users, virtualization and cluster environments often mean that changing a company’s IT strategy is neither economically nor politically feasible.
    [Show full text]
  • ZFS Basics Various ZFS RAID Lebels = & . = a Little About Zetabyte File System ( ZFS / Openzfs)
    = BDNOG11 | Cox's Bazar | Day # 3 | ZFS Basics & Various ZFS RAID Lebels. = = ZFS Basics & Various ZFS RAID Lebels . = A Little About Zetabyte File System ( ZFS / OpenZFS) =1= = BDNOG11 | Cox's Bazar | Day # 3 | ZFS Basics & Various ZFS RAID Lebels. = Disclaimer: The scope of this topic here is not to discuss in detail about the architecture of the ZFS (OpenZFS) rather Features, Use Cases and Operational Method. =2= = BDNOG11 | Cox's Bazar | Day # 3 | ZFS Basics & Various ZFS RAID Lebels. = What is ZFS? =0= ZFS is a combined file system and logical volume manager designed by Sun Microsystems and now owned by Oracle Corporation. It was designed and implemented by a team at Sun Microsystems led by Jeff Bonwick and Matthew Ahrens. Matt is the founding member of OpenZFS. =0= Its development started in 2001 and it was officially announced in 2004. In 2005 it was integrated into the main trunk of Solaris and released as part of OpenSolaris. =0= It was described by one analyst as "the only proven Open Source data-validating enterprise file system". This file =3= = BDNOG11 | Cox's Bazar | Day # 3 | ZFS Basics & Various ZFS RAID Lebels. = system also termed as the “world’s safest file system” by some analyst. =0= ZFS is scalable, and includes extensive protection against data corruption, support for high storage capacities, efficient data compression and deduplication. =0= ZFS is available for Solaris (and its variants), BSD (and its variants) & Linux (Canonical’s Ubuntu Integrated as native kernel module from version 16.04x) =0= OpenZFS was announced in September 2013 as the truly open source successor to the ZFS project.
    [Show full text]
  • Alternate Data Streams in NTFS
    Alternate Data Streams in NTFS Author: Conrad Chung, 2BrightSparks Introduction 20 years ago, Microsoft developed the Windows NT operating system based on the popular NT platform. Since then, it has continued to develop newer operating systems like Windows 8 and Windows Server 2012 using the same platform. Despite the widespread use of Microsoft’s operating systems, Windows users may not be aware of a lesser known feature in the NTFS file system (New Technology File System) called Alternate Data Streams (ADS). This article aims to provide some essential information on ADS as well as its uses and drawbacks. What are Alternate Data Streams? Since the introduction of Windows NT 3.1, NTFS has been the preferred file system developed by Microsoft for its NT-based operating systems. NTFS was implemented to replace the FAT (File Access Table) file system used by older operating systems like Windows 9x. Alternate Data Streams within NTFS allow the embedding of metadata in files or folders without altering their original functionality or content. In NTFS, the main data stream refers to the standard content (if any) of the file or folder, and this is usually visible to the user, while alternate data streams are hidden. The Windows operating system does not provide the means for any Microsoft Windows Utilities to detect the presence of ADS, thus they are not visible to the vast majority of file management applications like Windows Explorer. Alternate streams do not have any size limits and several streams can be linked to a normal file. The contents of ADS is not limited to text data; essentially any file that is in binary format can be embedded as an alternate stream.
    [Show full text]