Link Shell Extension is a software program for Windows NT operating systems like Windows XP, Windows Vista or Windows Server 2003 that supports the creation of hardlinks, junctions, volume mountpoints and Vista’s symbolic links. It provides the functionality as a shell extension in all supported operating systems meaning that it can be accessed from Windows [...]

>>Permalink

Stream Explorer is a handy application for Windows NT, Windows 2000, Windows XP and Windows Vista that displays the amount of streams, or more precisely NTFS Alternate Data Streams, of every subfolder and file of a selected folder. It therefor provides access to a very straightforward and visual way of identifying multiple data streams in [...]

>>Permalink

You might have already ready about Windows Alternate Data Streams (also known as System Forks on other operating systems) which are supported by most Windows operating systems that use NTFS (New Technology File System). Alternate Data Streams can contain any kind of information including textual, visual and executable. Malicious users can take advantage of the [...]

>>Permalink

The question came up just recently and I thought it would be nice to address it here in case other users are searching for a similar solution. If you want to format an USB device in Windows XP you notice that you can only select the FAT filesystem in the options. NTFS does not seem to be available which is rather strange at first glance but it becomes obvious pretty soon that this was not just another evil Microsoft plot to frustrate users.

>>Permalink

This article is going to explain NTFS Alternate Data Streams: what they are, where they are, how you can detect them, create them and how they are used by hackers. In short, NTFS Alternate Data Streams can be used by hackers to fork file data into existing files without altering the existing file’s function or size. You can guess where this is going, right ? They make it relatively easy to hide malicious code inside them which is much harder to detect.

>>Permalink