What if I told you that a file can contain more data than Windows Explorer shows you?

You create:

secret.txt

Windows Explorer shows:

secret.txt

You check its size.

Everything looks normal.

But on an NTFS volume, that file can have additional named data streams associated with it.

These are called:

NTFS Alternate Data Streams

or:

ADS

And this isn’t some exotic third-party hacking trick.

It’s a feature of the NTFS file system.

That makes ADS particularly interesting for cybersecurity.

Security researchers can use it to understand:

• Hidden data
• Windows file-system behavior
• Malware artifacts
• Digital forensics
• Suspicious files
• File metadata
• NTFS internals
• Anti-forensics techniques

And yes—you can experiment with ADS yourself using built-in Windows commands.

In this article, we’ll build a completely harmless ADS laboratory and see how a seemingly ordinary file can have additional data attached to it.

⚠️ Important Before You Start

These examples are designed for:

• Your own Windows computer
• A Windows virtual machine
• Cybersecurity labs
• Digital-forensics practice
• Authorized security research

We’re only creating harmless text streams.

Do not use hidden streams to conceal malware, stolen information, credentials, or unauthorized activity.

If you want to experiment heavily with NTFS, use a VM.

What Is an Alternate Data Stream?

Let’s start with a normal file.

Imagine:

C:\Lab\note.txt

Normally, you think of the file as:

note.txt
   ↓
data

NTFS can also associate named streams with the file:

note.txt
   │
   ├── $DATA
   │
   └── secret

Conceptually:

note.txt
├── Main data stream
└── Alternate data stream

The alternate stream doesn’t necessarily appear as another file in Windows Explorer.

That’s what makes ADS interesting.

Why Does NTFS Have This Feature?

Alternate Data Streams weren’t created specifically for hackers.

They are part of NTFS’s design and have legitimate uses.

Historically, named streams have been useful for storing additional information associated with a file.

Windows also uses NTFS metadata and file-system mechanisms for various purposes.

The security problem comes from the fact that:

A feature designed for legitimate file-system functionality can also be abused to hide information from ordinary file browsing.

This is a recurring cybersecurity theme.

The Most Important Concept

Suppose you have:

report.txt

You might assume:

report.txt

contains everything associated with the file.

With NTFS alternate streams, that assumption can be wrong.

The file can conceptually look like:

report.txt
│
├── Main content
│
└── Hidden-looking named stream
      └── Additional data

Windows Explorer may show only the normal file.

That doesn’t mean the additional stream doesn’t exist.

Your First ADS Lab

Let’s create a laboratory directory.

Open Command Prompt.

Run:

mkdir C:\ADS-Lab

Then:

cd C:\ADS-Lab

Create a normal file:

echo This is the visible file. > note.txt

Now check it:

type note.txt

You should see:

This is the visible file.

So far, nothing unusual.

Create an Alternate Data Stream

Now run:

echo This is data inside an alternate stream. > note.txt:hidden.txt

You have just created an alternate data stream named:

hidden.txt

associated with:

note.txt

The structure is conceptually:

note.txt
    └── hidden.txt

But don’t expect Windows Explorer to suddenly show another file.

That’s the interesting part.

Read the Alternate Stream

Run:

type note.txt:hidden.txt

You should see:

This is data inside an alternate stream.

You just stored additional data inside an NTFS file using a named stream.

Wait… Where Did the File Go?

Open:

C:\ADS-Lab

in Windows Explorer.

You’ll probably see:

note.txt

But not:

hidden.txt

That’s because:

note.txt:hidden.txt

isn’t a normal second file sitting next to note.txt.

It’s an alternate stream associated with the first file.

This is why ADS is fascinating from a forensic perspective.

Main File vs Alternate Stream

Think of the structure like this:

                 note.txt
                    │
          ┌─────────┴─────────┐
          │                   │
     Main stream         Alternate stream
          │                   │
          ▼                   ▼
"This is visible"       "This is hidden"

Windows Explorer primarily presents the normal file abstraction.

Command-line and forensic tools can reveal more.

Check the File Size

Run:

dir

You may notice something surprising.

The directory listing doesn’t necessarily make the alternate stream obvious.

That’s one reason ADS has historically been interesting to attackers and defenders.

However, don’t interpret:

“I don’t see it in Explorer”

as:

“The data is completely invisible.”

It isn’t.

Specialized tools and Windows APIs can inspect named streams.

Use dir /r

Windows provides a useful command for inspecting alternate streams:

dir /r

Run it inside:

C:\ADS-Lab

You may see output indicating the alternate stream associated with note.txt.

This is one of the easiest ways to demonstrate ADS without installing anything.

Your First ADS Investigation

Let’s repeat the experiment.

Run:

dir

Then:

dir /r

Compare the output.

This demonstrates an important security concept:

Normal file listing
       ↓
May not expose all named streams
Recursive/stream-aware inspection
       ↓
Can reveal additional data

Create Multiple Streams

You can create more than one alternate stream.

For example:

echo First stream > note.txt:stream1

and:

echo Second stream > note.txt:stream2

Now:

note.txt
├── stream1
└── stream2

Read them:

type note.txt:stream1

and:

type note.txt:stream2

This demonstrates that one NTFS file can have multiple named streams.

This Is Why ADS Is Interesting to Hackers

Imagine an attacker wants to hide information somewhere that a casual user isn’t likely to inspect.

A normal directory listing may show:

invoice.docx

but a stream-aware forensic tool could potentially reveal:

invoice.docx
└── suspicious_stream

That doesn’t mean ADS automatically provides stealth.

It simply provides an additional place where data can exist.

Modern security products and forensic tools can detect or inspect alternate streams.

ADS Has Legitimate Uses Too

This is important.

Don’t think:

ADS = malware

That’s incorrect.

NTFS features can have legitimate uses.

The presence of an alternate stream alone is not proof of malicious activity.

A security analyst should ask:

What stream exists?
Who created it?
When?
What is inside it?
Which application created it?
Is the file expected to have a stream?
Does the stream contain something suspicious?

Context matters.

ADS and Malware

Historically, malware authors have experimented with NTFS alternate streams for hiding data or components.

For example, an attacker could attempt to store information in:

legitimate-looking-file:extra

rather than creating an obvious second file.

But there are several limitations.

ADS:

• Requires an appropriate file system
• Doesn’t magically make data undetectable
• Can be discovered by security tools
• Can leave forensic artifacts
• Isn’t equivalent to encryption
• Isn’t a universal hiding mechanism

So don’t fall for the idea that:

“ADS means invisible malware.”

That’s not how it works.

ADS and Digital Forensics

This is where ADS becomes particularly valuable.

Imagine you’re investigating:

C:\Users\Alice\Downloads

and find:

invoice.pdf

Everything appears normal.

A forensic investigation might also inspect:

Named streams
File metadata
Creation timestamps
Modification timestamps
Security descriptors
File-system records

If an unexpected stream exists, the investigator can examine it.

That could reveal:

• Legitimate metadata
• Application-specific information
• Suspicious content
• Malware artifacts
• Evidence of unusual file manipulation

Again, the stream itself isn’t proof of anything.

It’s a lead.

ADS and File Downloads

Windows can attach metadata to downloaded files using mechanisms associated with NTFS and Windows security features.

One example is the Mark of the Web (MOTW), which can influence how Windows treats files originating from potentially untrusted locations.

This is an important reason not to delete or modify alternate streams blindly during forensic investigation.

A stream can contain legitimate security-related metadata.

Why This Matters for Security Researchers

Suppose you download:

setup.exe

from the internet.

The file may carry metadata indicating its origin.

Windows security features can use that information when deciding whether to warn you or apply restrictions.

So:

Alternate Data Streams

aren’t simply a hacker hiding place.

They can participate in legitimate Windows security behavior too.

Don’t Delete Streams You Don’t Understand

Imagine you’re doing incident response.

You discover:

file.exe:Zone.Identifier

Don’t immediately delete it.

Investigate it.

A security-related stream can contain information about the file’s origin.

This is an important forensic principle:

Preserve evidence before modifying it.

Inspect a Zone.Identifier Stream

On a file that has appropriate download-origin metadata, you may encounter:

Zone.Identifier

You can inspect a stream from CMD with:

more < "filename.exe:Zone.Identifier"

or:

type "filename.exe:Zone.Identifier"

Whether such a stream exists depends on how the file was obtained and the Windows/security configuration.

You might encounter information associated with the file’s origin zone.

What Is Mark of the Web?

Mark of the Web, commonly abbreviated:

MOTW

is a Windows security mechanism associated with files originating from potentially untrusted locations.

It can influence behaviors such as security warnings and Office Protected View or other application security decisions.

The exact behavior depends on the file type, Windows version, application, and security configuration.

This is one reason NTFS metadata can have security consequences beyond simple file storage.

ADS on FAT32

Here’s another important limitation.

Alternate Data Streams are associated with NTFS functionality.

If you move a file to a file system that doesn’t support named streams in the same way, the stream may not survive as an NTFS alternate stream.

For example:

NTFS
 ↓
ADS supported

while:

FAT32
 ↓
No equivalent NTFS ADS mechanism

This is one reason you shouldn’t assume an ADS will remain intact after copying a file between different file systems.

ADS on USB Drives

This creates an interesting experiment.

Create:

note.txt

with an alternate stream on an NTFS volume.

Then copy it to different storage formats.

You may find that the alternate stream behaves differently depending on the destination file system and copy mechanism.

This is a great way to learn:

File system
     ↓
Metadata
     ↓
Copy behavior
     ↓
Security consequences

ADS and Windows Explorer

Windows Explorer is designed to provide a convenient file-management interface.

It isn’t a complete forensic file-system viewer.

That’s an important distinction.

Think of:

Explorer

as:

“Show me the files a normal user needs.”

while a forensic investigation asks:

“Show me everything associated with this file.”

Those are different requirements.

Find ADS With PowerShell

PowerShell can also help investigate alternate streams.

For example:

Get-Item .\note.txt -Stream *

Depending on the Windows/PowerShell environment, this can show streams associated with the file.

For example, you might see:

Stream
------
:$DATA
hidden.txt

The exact output can vary.

This is a useful defensive command to remember.

Scan a Directory for Alternate Streams

You can investigate files recursively.

For example:

Get-ChildItem C:\ADS-Lab -Recurse -File |
    Get-Item -Stream * |
    Where-Object Stream -ne ':$DATA'

This asks PowerShell to look for streams beyond the normal unnamed data stream.

Use this on directories you own or are authorized to investigate.

Build a Simple ADS Scanner

Now let’s make a small defensive script.

Create:

ads-scanner.ps1

$Path = "C:\ADS-Lab"
Write-Host "====================================="
Write-Host "       NTFS ADS SECURITY SCANNER"
Write-Host "====================================="
Write-Host ""
Get-ChildItem $Path -Recurse -File -ErrorAction SilentlyContinue |
ForEach-Object {
    try {
        $streams = Get-Item $_.FullName -Stream * -ErrorAction Stop
        foreach ($stream in $streams) {
            if ($stream.Stream -ne ":$DATA") {
                Write-Host "[FOUND]" $_.FullName
                Write-Host "        Stream:" $stream.Stream
                Write-Host "        Size:" $stream.Length
                Write-Host ""
            }
        }
    }
    catch {
        # Ignore files that cannot be inspected.
    }
}

Run it against your lab.

It will identify named streams other than the ordinary file data stream.

That’s already a useful defensive exercise.

Make the Scanner Save Results

You can extend it:

$Path = "C:\ADS-Lab"
$Output = "$env:USERPROFILE\Desktop\ads_report.txt"
"NTFS ADS REPORT" | Out-File $Output
"============================" | Out-File $Output -Append
Get-ChildItem $Path -Recurse -File -ErrorAction SilentlyContinue |
ForEach-Object {
    try {
        $streams = Get-Item $_.FullName -Stream * -ErrorAction Stop
        foreach ($stream in $streams) {
            if ($stream.Stream -ne ":$DATA") {
                "File: $($_.FullName)" |
                    Out-File $Output -Append
                "Stream: $($stream.Stream)" |
                    Out-File $Output -Append
                "Size: $($stream.Length)" |
                    Out-File $Output -Append
                "" |
                    Out-File $Output -Append
            }
        }
    }
    catch {}
}
Write-Host "Report saved to:"
Write-Host $Output

Now you’ve built a simple ADS auditing tool.

Can BAT Files Work With ADS?

Yes.

That’s one of the fun parts.

For example:

@echo off
echo Secret lab data > note.txt:hidden.txt
echo Created ADS.
echo.
echo Reading ADS:
type note.txt:hidden.txt
pause

This gives you a tiny BAT-based ADS demonstration.

Combine BAT + PowerShell + ADS

Now let’s combine your recent Windows topics.

BAT
 ↓
PowerShell
 ↓
NTFS
 ↓
Alternate Data Streams
 ↓
Security Analysis

Create:

ads-lab.bat

@echo off
echo ==================================
echo         NTFS ADS LAB
echo ==================================
if not exist C:\ADS-Lab mkdir C:\ADS-Lab
cd /d C:\ADS-Lab
echo Visible content > note.txt
echo Hidden-looking lab content > note.txt:labdata
echo.
echo Visible file:
type note.txt
echo.
echo Alternate stream:
type note.txt:labdata
echo.
echo Directory listing:
dir /r
echo.
echo ==================================
echo Lab complete.
echo ==================================
pause

Run it inside your own lab.

Now you’ve created:

note.txt
└── labdata

without creating a second normal file.

Can You Put Binary Data in an ADS?

Technically, NTFS streams aren’t limited to human-readable text.

They can contain arbitrary file data.

But for a safe learning lab, don’t experiment with executable payloads or malicious binaries.

Use harmless content such as:

TXT
JSON
CSV

The goal is to understand the file-system mechanism.

ADS Is Not Encryption

This is a very important misconception.

If you put:

MyPassword123

inside an alternate stream, it isn’t encrypted.

Someone who discovers the stream can read it.

Therefore:

ADS ≠ Encryption

If information needs confidentiality, use proper encryption.

ADS Is Not Secure Storage

Don’t use:

file.txt:secret

as a password vault.

It isn’t one.

It is simply another data stream associated with a file.

Security through obscurity is not a substitute for encryption and access controls.

ADS Is Not Magic Stealth

A common internet claim is:

“Hackers can completely hide files using ADS.”

That’s exaggerated.

Security tools can inspect alternate streams.

PowerShell can inspect them.

Forensic software can inspect them.

Specialized scanners can identify them.

And modern security products may detect suspicious behavior involving them.

So the correct lesson is:

ADS can conceal data from casual file browsing, but it doesn’t make the data invisible.

Why Defenders Should Care

Imagine an organization discovers:

invoice.docx

on a workstation.

A normal user sees one file.

A security analyst may ask:

Does it have alternate streams?
What are they?
Who created them?
What do they contain?
Does the file have download-origin metadata?
Is the file expected to have those streams?

This adds another layer to investigation.

ADS Hunting During Incident Response

If you’re investigating a potentially compromised Windows system, consider examining:

Downloads
Desktop
Temp
AppData
Shared folders
Recently modified files
Suspicious executables
Office documents
Scripts

and checking for unexpected streams.

But don’t interpret every stream as malicious.

Forensic analysis is about evidence and context.

ADS and Malware Analysis

Suppose you’re analyzing a suspicious sample in a sandbox.

You might inspect:

File
 ├── Main stream
 └── Named streams

If unexpected streams exist, investigate:

What is stored there?
Was it created by the application?
When?
Does the stream change during execution?

This can reveal additional behavior.

ADS and File Timestamps

Another interesting forensic question is timing.

Suppose:

document.docx

has an unexpected stream.

You may want to compare:

File creation
File modification
Stream modification
Download origin
Process activity

The goal isn’t just to find hidden data.

It’s to reconstruct:

What happened?

A Mini ADS Forensics Challenge

Here’s a great cybersecurity lab.

Create:

C:\ADS-Lab

Then create:

report.txt

with:

Quarterly report

Add:

report.txt:notes

with:

Internal lab note

Then add:

report.txt:metadata

with:

Created for forensic training

Now pretend you are an investigator.

Your challenge:

1. Find the file.
2. Determine whether it has alternate streams.
3. Identify the stream names.
4. Determine their sizes.
5. Read the contents.
6. Document the evidence.
7. Explain why the normal directory listing wasn’t enough.

You’ve just created a simple digital-forensics exercise.

What an Analyst Should Record

When documenting a suspicious ADS, record:

File path
Stream name
Stream size
File timestamps
File hash
Stream contents
Parent directory
Creation/modification context
Associated process
User account

Don’t modify the original evidence if you’re performing a real forensic investigation.

Work from a forensic copy where appropriate.

ADS Detection Checklist

When investigating a Windows system:

1. Identify suspicious files

Look at:

Downloads
Temp
AppData
Desktop
Documents

2. Inspect alternate streams

Use appropriate Windows/forensic tools.

3. Investigate stream names

Ask whether the name makes sense.

4. Examine stream contents

Don’t execute unknown content.

5. Check file origin metadata

MOTW-related information can be relevant.

6. Correlate timestamps

Compare file activity with:

Event Logs
Process activity
Browser history
Downloads

7. Determine legitimacy

Not every stream is malicious.

Common ADS Mistakes

❌ Mistake 1: Assuming every ADS is malware

Wrong.

Some streams are legitimate.

❌ Mistake 2: Assuming ADS is invisible

Wrong.

Specialized tools can detect them.

❌ Mistake 3: Using ADS as encryption

Wrong.

It’s not encryption.

❌ Mistake 4: Deleting every stream you find

Bad forensic practice.

Investigate first.

❌ Mistake 5: Assuming Explorer shows everything

Explorer is not a complete forensic interface.

ADS vs Normal Files

The Really Interesting Part

Here’s the mental model you should remember:

Windows Explorer asks:
"What files are here?"

A forensic analyst asks:

"What data is associated with these files?"

Those aren’t the same question.

And that difference is where NTFS Alternate Data Streams become interesting.

From ADS to Windows Forensics

If you’re enjoying this type of Windows security research, ADS is only one part of a much larger world.

Your learning path can become:

Windows Files
      ↓
NTFS
      ↓
Alternate Data Streams
      ↓
File Metadata
      ↓
Event Logs
      ↓
Registry
      ↓
Processes
      ↓
WMI
      ↓
PowerShell
      ↓
Windows Forensics

Notice how your previous Windows topics now connect together.

You’re no longer learning random tricks.

You’re learning how Windows actually works.

15-Minute ADS Lab

If you want a quick experiment right now:

Step 1

Open CMD.

Step 2

Run:

mkdir C:\ADS-Lab
cd C:\ADS-Lab

Step 3

Create a normal file:

echo Hello Windows > test.txt

Step 4

Create an alternate stream:

echo This is an ADS lab > test.txt:secret

Step 5

Read the normal file:

type test.txt

Step 6

Read the stream:

type test.txt:secret

Step 7

Inspect streams:

dir /r

Step 8

Use PowerShell:

Get-Item .\test.txt -Stream *

That’s the entire experiment.

No malware.

No exploit.

No third-party tool.

Just Windows and NTFS.

Frequently Asked Questions

What is an NTFS Alternate Data Stream?

An Alternate Data Stream is a named data stream associated with a file on NTFS. It allows additional data to be stored alongside the file’s normal data stream.

Can Windows Explorer show ADS?

Explorer generally doesn’t present named alternate streams as ordinary separate files, which is why specialized commands and forensic tools are useful when investigating them.

Are Alternate Data Streams dangerous?

Not inherently. ADS is an NTFS feature with legitimate uses. It can, however, be abused to hide data or support malicious activity.

How do I see ADS on Windows?

For a simple lab, use:

dir /r

or PowerShell:

Get-Item .\file.txt -Stream *

Can ADS contain malware?

Technically, arbitrary data can be stored in streams, but discovering an ADS does not by itself prove malware is present.

Does ADS work on FAT32?

NTFS alternate data streams are an NTFS feature and aren’t supported in the same way by FAT32.

Is ADS encryption?

No. ADS is a storage mechanism, not an encryption mechanism.

Can hackers hide files using ADS?

Attackers have historically abused ADS to conceal data from casual file browsing. However, ADS can be detected by security and forensic tools and shouldn’t be considered invisible.

What is Zone.Identifier?

It is a Windows-related alternate stream commonly associated with Mark of the Web information for files obtained from potentially untrusted locations. Its presence and contents depend on how the file was obtained and the system/application configuration.

Final Takeaway

Windows Explorer makes your computer look simple.

file.txt
photo.jpg
invoice.pdf
setup.exe

But the NTFS file system can contain more information than that simple list suggests.

A file can conceptually contain:

             FILE
               │
       ┌───────┴───────┐
       │               │
 Main Data       Alternate Data
  Stream             Streams
       │               │
       ▼               ▼
Visible content   Additional data

That’s why NTFS Alternate Data Streams are such an interesting Windows security topic.

For attackers, they have historically provided a way to hide data from casual inspection.

For defenders, they are another artifact worth understanding.

For forensic investigators, they can contain important evidence.

And for cybersecurity students, they’re a perfect example of why:

What you see in Windows Explorer isn’t necessarily the complete picture of what’s stored on the file system.

Build the lab.

Create a harmless stream.

Inspect it.

Then delete the lab directory when you’re finished.

Once you understand ADS, start connecting it with the other Windows concepts you’ve learned:

Registry → Event Logs → WMI → PowerShell → NTFS → Forensics.

That’s where Windows security gets really interesting.

Think Like an Attacker. Investigate Like a Defender. Secure Like a Pro.