75. NTFS Data Streams

• NTFS data stream is a unique set of file attributes.

• NTFS supports multiple data streams per file:

  • one main stream

  • plus an optional set of alternate data streams

• A data stream can be created in an existing file on an NTFS volume using a command like

  
      C:\>ECHO hello > myfile.txt:stream1
  
  

  To display the contents of the data stream,

  
      C:\>MORE < myfile.txt:stream1
  
  

• A data stream does not appear when a file is opened in a text editor!

• The only way to see if a data stream is attached to a file is by examining the MFT entry for the file.