21 August 2007

NTFS streams:

Files and directories on NTFS partitions are collection of attributes, such as the creation time, security descriptor, file name, last access time etc. The file's data is just another file attribute. All files have at least one unnamed data attribute (default data). This unnamed attribute is the primary data stream of the file. Upon file creation, an unnamed stream is allocated to hold the file's data. A file can also optionally have one or more named data attributes. These additional named are the file's alternate data streams.

A stream is a hidden file that is linked to a normal (visible) file. A stream is not limited in size and there can be more than one stream linked to a normal file. For example, you may have a file with a zero size but with 1 GB of the alternate data streams, which are invisible for you. The operating system does not report information about any of the additional streams that may be part of the file.

No comments:

Custom Search