O'Reilly logo

Windows Forensics and Incident Recovery by Harlan Carvey

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

NTFS Alternate Data Streams

The NTFS file system is the recommended file system for use with Windows servers. The file system has a number of advantages over the FAT file system, such as support for greater partition sizes, enhanced fault tolerance, and the ability to set permissions and auditing on directories and files. Since the beginning, the NTFS file system has included support for Apple's Hierarchical File System, or HFS. Files on HFS consist of two forks, a resource fork and a data fork. What this means is that on the NTFS file system, a file entry within the Master File Table (MFT) can have additional attributes, specifically additional streams associated with the primary stream.

To better understand what an alternate data stream (ADS) ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required