Hiding files with ntfs streams

When you copy files from an ntfs partition to a non-ntfs partition, you may occasionally encounter the following situation: the system prompts that data will be lost. What is the problem?

In fact, the ntfs file system introduces the concept of "stream". Each file can have multiple streams, but we generally only use one. By allocating more streams to the file, it can realize "file hiding" in a certain sense ". for example, you can use the following command in the console to create a text file:
Dir d:> abc.txt
It lists all the files in the d: root directory, and then redirects them to the abc.txt file. Now you can check the size and content of the abc.txt file and record it. Then run the following command dir c:> abc.txt: stream.txt
After the script is executed, check that the size and content of abc.txt have not changed. However, the actual abc.txthas already added a stream.txt stream, and the redirected content is output to it. The cursor ends, otherwise the notepad cannot be found ):
Notepad abc.txt: stream.txt
In this way, a file is hidden. the dir command cannot be seen, the file attributes cannot be seen, and the resource manager cannot be seen. If you do not know the stream name, notepad cannot be accessed.

In fact, the stream does not depend on the file. The following command is also valid (do not try it first, otherwise it may be a bit troublesome ):
Dir e:>: stream.txt
This is to bind the stream to a folder, which is more concealed. generally, to delete a stream, you only need to delete its host. If you execute the command and run it on the root folder, if you want to delete it, congratulations! You want to resize the disk :). however, it is not difficult to delete a stream by writing a program. You only need to call DeleteFile and provide the stream name. to enumerate all streams in a file, only BackupRead can be used currently. I wrote a small program that can be used to enumerate, delete, and import and export data in the stream. The following is its code (the writing is too hasty, and there may be some bugs, however, the main functions are all implemented. Its name is nsvw, that is, Ntfs Stream Viewer ).