ADS
Alternate Data Streams
Alternative Datenströme (NTFS)
Alternate data streams are a peculiarity of the NTFS file system: additional, invisible data streams can be attached to a file that do not appear in the normal directory listing. What is intended as a legitimate feature is readily misused to hide data or malicious code. For forensics, ADS are a known hiding place.
History & facts. NTFS allows further named data streams to be stored alongside the actual content of a file; in the file explorer and with a simple size display these remain invisible. This is used legitimately for metadata, for instance (such as marking files downloaded from the internet). Attackers, however, can hide data or executable code in them that is overlooked on superficial inspection — an anti-forensic technique.
Outlook & recommendation. For forensic investigation: ADS are only captured when tools are used that explicitly read them out; a mere file copy can lose them. On the defence side, the awareness helps that the displayed file size is not everything. Hidden data streams are a classic example of legitimate system functions being repurposed — and of why forensic diligence must go beyond the visible surface.