Monday, June 29, 2015

Alternative Data Streams

I've now run into this twice which means I need a way to remember this problem solution.

Windows NTFS has a method for recording Alternative Data Streams with files.  When you download files from the Internet IE may add an Alt. data stream that includes the Internet Zone the file was downloaded from.  There is a neat PowerShell command for viewing the stream called get-item filename.exe -stream *.

You can use SysInternals stream.exe to view and delete these alternative data streams.  I have not found a way to delete streams within PowerShell.

Here is the best article about the topic:

http://blogs.technet.com/b/askcore/archive/2013/03/24/alternate-data-streams-in-ntfs.aspx

Edit:
Found the PowerShell method

get-item <filename> -stream *
remove-item <filename> -stream zone.identifier

5 comments:

  1. Thanks for a wonderful share. Your article has proved your hard work and experience you have got in this field. Brilliant .i love it reading. health coaching program template

    ReplyDelete
  2. This post is very simple to read and appreciate without leaving any details out. Great work! website

    ReplyDelete
  3. The NIH board said that, "there are various cases" where needle therapy works. Since the treatment has less incidental effects and is less intrusive than ordinary medicines, "the time has come to view it in a serious way" and "grow its utilization into traditional medicine."
    Fastest manifestation technique

    ReplyDelete
  4. As the economy heads further down the slippery slope of what promises to be a deep recession, and our healthcare infrastructure continues to grow and age, it is a natural progression to see more and more IAQ professionals turn to what some believe is a recession resistant market. best staffing agency Ohio

    ReplyDelete
  5. Great Job. This is a very useful website. This article is really helpful. Thank you so much for sharing this great knowledge.
    BLUNA Face fit KF94 For Adults | Black-Adjustable | Sale | Up to 70% Off.

    ReplyDelete