Alternate Data Streams are features of Microsoft's NTFS filesystem. They allow single file to reference multiple independent 'streams' of data and are most commonly used to store file metadata.
On NTFS volumes, each file and directory must have at least one Data Stream
. The main, unnamed, data stream refers to the actual data stored in the file. Additional (or Alternate
) file streams can be attached to a file/folder by giving unique names to each alternate stream. These alternate streams may then be accessed by specifying the whole path to the file followed by a colon and the name of the stream. For example, this file path refers to the ADS named "MyStream" attached to a file named "MyFile.dat".
C:\Example\MyFile.dat:MyStream
Alternate streams may contain data a normal file can contain, and are not restricted in size, type, or number. Newer versions of Windows (Vista+) will refuse to execute programs stored as alternate streams (a security measure against running invisible EXE's)