Alternate data streams are a special feature of the NTFS file system. In the older FAT32 file system, each file record could have only a file name and the file data associated with it. But in NTFS, each record could be linked to filename, a main data stream and several alternate data streams. The main data stream for a file is where you usually save the file data. For example, if you use Notepad to create a new TXT file, the contents of that TXT file will be saved in that file’s main data stream. But the alternate data streams could also exist associated with the same file and containing entirely different data.
Recently, we posted about a tool called Phrozen ADS Revealer that can be used to search and delete the hidden alternate data streams on your system. But in order to test the tool, we had to create a tool of our own called “Alternate Data Streams” that can be used to create alternate data streams associated with any file very easily. The tool is very small and is designed using C language which means it is completely portable.
You have to select a file for which you want to create the alternate data streams, you have to pick a name for the newly created stream and the data for the stream. The tool does not support binary data and you can enter only text data. The reason for this we did not want this tool to be used for hiding malicious binary content. After this, you have to click on the Save button and it will save the alternate data stream. You can create as many alternate data streams as you want for the same file.
You can download “Alternate Data Streams” tool from https://www.trishtech.com/downloads/alternatedatastreams.zip.