alternate-data-streams

Removes the Zone.Identifier alternate data stream that identifies files as 'from the internet'

Read, write and delete Alternate Data Streams (ADS) within NTFS, to hide malicious payloads

A command-line utility for managing alternate data streams in files on NTFS file systems.

ZoneStripper Shell Extension

List all data (including Alternate Date Streams) under linux using the getfattr command

C++ class to deal with Alternate Data Streams (Win32) plus a little tool based on it. No pull requests (this is actually a mirrored Mercurial repo).

From-scratch NTFS reader (ntfs-core: MFT, attributes, indexes, data runs, LZNT1, $UsnJrnl:$J change journal over Read+Seek) plus a graded anomaly auditor (ntfs-forensic: timestomping, alternate data streams, deleted records, MFT/LogFile tamper checks) — panic-free, fuzzed, no unsafe

Karmanti — Licence-gated, zero-disk, dump-resistant execution for Windows binaries: ADS staging + kernel DACL + 1024-bit Schnorr licences — no driver, no server.

Data Fillar & Pumper, ADS Manipulations in Python Just for filling drives with bunch of data and user will unable to check that where the data is added!

Alternate Data Streams (ADS) in NTFS allow multiple data streams to be associated with a single file. In addition to the main data stream, files can store extra data under different names. This feature is often used for metadata but can also be exploited to hide information or malware within a file.

Hierarchical .dropboxignore files for Dropbox. Writes ignore markers via NTFS ADS on Windows and xattrs on Linux/macOS.

Unprivileged NTFS Alternate Data Stream manager. All in one NTFS-ADS tool!

A steganography project that conceals various types of data within audio and video files, using advertisements (ads) as the cover media.

Access NTFS(New Technology File System) ADS(Alternate Data Stream) using golang.

Enterprise NTFS Alternate Data Stream (ADS) inspector: detects hidden streams attached to a file, flags likely-executable/script payloads, shows a decoded preview for analyst review, and forwards high-risk detections to Splunk HEC and/or Elastic Security.

A SQLite engine, database, and interface contained in a single PowerShell file using NTFS Alternate Data Streams.

Documenting my journey through the IBM SkillsBuild Cyber Security Bootcamp with BharatCares — learning, exploring digital forensics, and building StreamSafe along the way.