The Dark Side of NTFS (MicrosoftÂ’s Scarlet Letter)

Author: H. Carvey Published Feb. 28, 2011 from InfoSec Writers

Admins & users know very little about a feature of the NTFS file system called 'alternate data streams' (ADSs). This paper describes in detail how ADSs are created and manipulated, and how code hidden in ADSs can be executed. Specific differences in the treatment of ADSs by NT, 2K, and XP are noted.