AlternateStreamView - View/Copy/Delete NTFS Alternate Data Streams

AlternateStreamView v1.12 - View/Copy/Delete NTFS Alternate Data Streams
Copyright (c) 2009 Nir Sofer

Description

AlternateStreamView is a small utility that allows you to scan your NTFS drive, and find all hidden alternate streams stored in the file system. After scanning and finding the alternate streams, you can extract these streams into the specified folder, delete unwanted streams, or save the streams list into text/html/csv/xml file.

System Requirements

This utility works on any version of Windows starting from Windows 2000 and up to Windows 7.

Versions History

Version 1.12:
- Fixed the problem with icons on Windows 7/x64 systems.
Version 1.11:
- Added 'Explorer Copy' option - copy selected files and then paste them into Explorer window.
Version 1.10:
- Added support for choosing the folder depth of subfolders scanning.
Version 1.05:
- Fixed bug: In Windows Vista, NTFS junction point to 'Application Data' folder created a recursive scan. In this version, AlternateStreamView automatically skip junction points.
- Fixed bug: AlternateStreamView failed to delete streams of read-only files.
- Fixed bug: AlternateStreamView allowed to close the main window during scan.
Version 1.00 - First release.

About Alternate Streams in NTFS File System

NTFS system has a feature that allows to add multiple streams in addition to the main file stream. When you open or view the file, only the main file stream is visible, while other additional streams are hidden from the user.

Here's 3 examples of alternate streams usage in Windows operating system:

Favorites of Internet Explorer: When You add a Web site link into your 'Favorites', a .url file containing the url and description is created. However, if the Web site also have an icon (favicon), the icon is saved as alternate stream for the same url file. The stream name of the icon is :favicon:$DATA
Downloaded files of Internet Explorer: When you download and save a file with Internet Explorer, it automatically add a zone information for the saved file. This zone information is used for identifying the file as downloaded file from the Internet. The stream name in this case is :Zone.Identifier:$DATA
Summary information of files: When you right-click on a file in Explorer and go to the 'Summary' tab, you can add summary information for the file, like title, subject, author, and so on. This summary information is also saved into alternate stream. The stream name in this case is SummaryInformation:$DATA.

In addition to the legitimate usage of alternate streams, this technique may also be used by Viruses/Trojans/Spywares for saving data and hiding it from the user.

Using AlternateStreamView

AlternateStreamView doesn't require any installation process or additional DLL files. In order to start using it, simply run the executable file - AlternateStreamView.exe
After running it, choose the drive or folder that you wish to scan, and click Ok. AlternateStreamView will scan the selected folder, and then it'll display all alternate streams found in the selected drive/folder. After the scan is finished, you can select one or more alternate streams, and then delete them ('Delete Selected Streams' option), or copy them into a folder that you choose ('Export Selected Streams To...').

Translating AlternateStreamView to other languages

In order to translate AlternateStreamView to other language, follow the instructions below:

Run AlternateStreamView with /savelangfile parameter:
AlternateStreamView.exe /savelangfile
A file named AlternateStreamView_lng.ini will be created in the folder of AlternateStreamView utility.
Open the created language file in Notepad or in any other text editor.
Translate all string entries to the desired language. Optionally, you can also add your name and/or a link to your Web site. (TranslatorName and TranslatorURL values) If you add this information, it'll be used in the 'About' window.
After you finish the translation, Run AlternateStreamView, and all translated strings will be loaded from the language file.
If you want to run AlternateStreamView without the translation, simply rename the language file, or move it to another folder.

License

This utility is released as freeware. You are allowed to freely distribute this utility via floppy disk, CD-ROM, Internet, or in any other way, as long as you don't charge anything for this. If you distribute this utility, you must include all files in the distribution package, without any modification !

Disclaimer

The software is provided "AS IS" without any warranty, either expressed or implied, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. The author will not be liable for any special, incidental, consequential or indirect damages due to loss of data or any other reason.

Feedback

If you have any problem, suggestion, comment, or you found a bug in my utility, you can send a message to nirsofer@yahoo.com

Download AlternateStreamView

AlternateStreamView is also available in other languages. In order to change the language of AlternateStreamView, download the appropriate language zip file, extract the 'alternatestreamview_lng.ini', and put it in the same folder that you Installed AlternateStreamView utility.

Language Translated By Date Version
French Hp67 21/07/2009 1.10
German «Latino» auf WinTotal.de 11/12/2009 1.12
Italian REMIGIO_78 16/02/2009 1.05
Russian solokot 01/09/2009 1.11
Simplified Chinese renda 02/09/2009 1.11
Simplified Chinese ÄÏ·½µÄÓê 14/02/2009 1.00
Spanish arquer.net 20/05/2009 1.05
Valencian vjatv 17/02/2009 1.05