ads playground

ads.ps1

#Create 'normal' file with some content.
New-Item -Name .\adstest1.txt -ItemType File -Value 'This is normal content.'

#Show content...
Get-Content -Path .\adstest1.txt

#Show Alternate Data Streams - only ':$DATA'
Get-Item -Path .\adstest1.txt -Stream *

#Add ADS named SecretADS with some content
Set-Content -Path .\adstest1.txt -Stream 'SecretADS' -Value 'This is spooky content.'

#Show ADS - ':$DATA' and 'SecretADS'
Get-Item -Path .\adstest1.txt -Stream *

#Show hidden content from ADS
Get-Content -Path .\adstest1.txt -Stream 'Secretads'

#Show all files with additional ADS (not: ':$DATA' and 'Zone.Identifier')
Get-ChildItem -Recurse |
ForEach-Object { Get-Item -Path $_.FullName -Stream * } |
Where-Object { ($_.Stream -ne ':$Data' -and $_.Stream -ne 'Zone.Identifier') }

# try: notepad DownloadedFile:ADSName, download with different browsers
# ZoneId=0: Local machine
# ZoneId=1: Local intranet
# ZoneId=2: Trusted sites
# ZoneId=3: Internet
# ZoneId=4: Restricted sites

#https://docs.microsoft.com/en-us/archive/blogs/askcore/alternate-data-streams-in-ntfs
#http://www.rootkitanalytics.com/userland/Exploring-Alternate-Data-Streams.php
#https://www.nirsoft.net/utils/alternate_data_streams.html
#https://docs.microsoft.com/en-us/sysinternals/downloads/streams