<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>gHacks technology news &#187; system forks</title>
	<atom:link href="http://www.ghacks.net/tag/system-forks/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.ghacks.net</link>
	<description>A technology blog covering software, mobile phones, gadgets, security, the Internet and other relevant areas.</description>
	<lastBuildDate>Tue, 24 Nov 2009 23:31:44 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.8.6</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>Hide Information in Files</title>
		<link>http://www.ghacks.net/2008/06/30/hide-information-in-files/</link>
		<comments>http://www.ghacks.net/2008/06/30/hide-information-in-files/#comments</comments>
		<pubDate>Mon, 30 Jun 2008 19:24:47 +0000</pubDate>
		<dc:creator>Martin</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[Windows]]></category>
		<category><![CDATA[Alternate Data Streams]]></category>
		<category><![CDATA[file system]]></category>
		<category><![CDATA[ntfs]]></category>
		<category><![CDATA[system forks]]></category>
		<category><![CDATA[windows-nt]]></category>

		<guid isPermaLink="false">http://www.ghacks.net/?p=5156</guid>
		<description><![CDATA[You might have already ready about Windows Alternate Data Streams (also known as System Forks on other operating systems) which are supported by most Windows operating systems that use NTFS (New Technology File System). Alternate Data Streams can contain any kind of information including textual, visual and executable. Malicious users can take advantage of the [...]]]></description>
			<content:encoded><![CDATA[<p>You might have already ready about Windows Alternate Data Streams (also known as System Forks on other operating systems) which are supported by most Windows operating systems that use NTFS (New Technology File System). Alternate Data Streams can contain any kind of information including textual, visual and executable. Malicious users can take advantage of the fact that the size of the additional content is not added to the size of the file in a directory listing. A 10 Kilobyte image will still show a size of 10 Kilobyte if someone else adds a 1 Megabyte executable to it.</p>
<p>Basically anything can be added to an existing file (and directory) which brings up an interesting method of hiding important data on the system. Say you want to keep your passwords on the computer but do not want to use a text document to have them in the open. Using Alternate Data Streams to hide them from prying eyes could be a relative secure method of storing the password list on the computer.</p>
<p>They are detectable if the right software is being used. Windows Vista users can also use the <em>dir *.txt /R</em> which is further explained at <a href="http://bartdesmet.net/blogs/bart/archive/2006/07/13/4129.aspx">Bart De Smet&#8217;s</a> on-line blog.</p>
<p><span id="more-5156"></span>To add textual information to any file in Windows you could use the command <em>notepad filename:name</em> for example <em>notepad image.jpg:secret</em>. This would open up Notepad and a blank text file at the first run. Any text that is added and saved during that session will the shown if the user opens the text document with the same command at a later time.</p>
<p>Executable files or other binary files can be added with the type command like this: type <em>c:\text.exe > hello.txt:text.exe</em> which can be executed with the start command <em>start .\hello.txt:text.exe</em>.</p>

	Tags: <a href="http://www.ghacks.net/tag/alternate-data-streams/" title="Alternate Data Streams" rel="tag">Alternate Data Streams</a>, <a href="http://www.ghacks.net/tag/file-system/" title="file system" rel="tag">file system</a>, <a href="http://www.ghacks.net/tag/ntfs/" title="ntfs" rel="tag">ntfs</a>, <a href="http://www.ghacks.net/tag/system-forks/" title="system forks" rel="tag">system forks</a>, <a href="http://www.ghacks.net/tag/windows/" title="Windows" rel="tag">Windows</a>, <a href="http://www.ghacks.net/tag/windows-nt/" title="windows-nt" rel="tag">windows-nt</a><br />

	<h4>Related posts</h4>
	<ul class="st-related-posts">
	<li><a href="http://www.ghacks.net/2008/07/26/stream-explorer/" title="Stream Explorer (July 26, 2008)">Stream Explorer</a> (0)</li>
	<li><a href="http://www.ghacks.net/2009/01/29/windows-xp-exfat-file-system-driver/" title="Windows XP exFAT File System Driver (January 29, 2009)">Windows XP exFAT File System Driver</a> (21)</li>
	<li><a href="http://www.ghacks.net/2008/04/12/surun-beats-all-sudo-like-applications-in-windows/" title="Surun beats all Sudo like applications in Windows (April 12, 2008)">Surun beats all Sudo like applications in Windows</a> (5)</li>
	<li><a href="http://www.ghacks.net/2007/11/15/still-running-fat32-time-to-convert-to-ntfs/" title="Still running Fat32 ? Time to convert to NTFS (November 15, 2007)">Still running Fat32 ? Time to convert to NTFS</a> (3)</li>
	<li><a href="http://www.ghacks.net/2007/01/06/remove-ntfs-timestamps-to-speed-up-vista/" title="Remove Ntfs Timestamps to speed up Vista (January 6, 2007)">Remove Ntfs Timestamps to speed up Vista</a> (7)</li>
</ul>

]]></content:encoded>
			<wfw:commentRss>http://www.ghacks.net/2008/06/30/hide-information-in-files/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
