{"id":306,"date":"2007-03-25T03:57:00","date_gmt":"2007-03-25T03:57:00","guid":{"rendered":"https:\/\/defragged.org\/ossec\/?p=306"},"modified":"2020-07-03T03:58:06","modified_gmt":"2020-07-03T03:58:06","slug":"finding-ads-on-ntfs","status":"publish","type":"post","link":"https:\/\/defragged.org\/ossec\/2007\/03\/finding-ads-on-ntfs\/","title":{"rendered":"Finding ADS on NTFS"},"content":{"rendered":"\n<p><strong>ADS<\/strong>&nbsp;(Alternate Data Streams) is a \u201cfeature\u201d of the&nbsp;<strong>NTFS<\/strong>&nbsp;(file system used on Windows 2000, XP, etc) that permit files to be completely hidden from the system. You can read more about ADS in these two links:&nbsp;<a href=\"http:\/\/www.windowsecurity.com\/articles\/Alternate_Data_Streams.html\">windowsecurity.com ADS<\/a>&nbsp;and&nbsp;<a href=\"http:\/\/www.heysoft.de\/nt\/ntfs-ads.htm\">lads<\/a>.<\/p>\n\n\n\n<p>Currently I am working on merging rootcheck (an anomaly detection module) to Windows and one of the things it needs to detect is hidden files using&nbsp;<strong>NTFS ADS<\/strong>. However, so far, I couldn\u2019t find&nbsp;<strong>any<\/strong>&nbsp;open source tool that detects them (yes, there is freeware programs out there, but no source code). Most of the articles I read point to&nbsp;<a href=\"http:\/\/www.heysoft.de\/nt\/ntfs-ads.htm\">lads<\/a>, which is free, but not open source.<\/p>\n\n\n\n<p>So, to fill this gap, I am releasing a beta version of a small tool (ads_dump) that scans a given directory and prints every ADS found. It is a standalone tool, but it will be soon included into&nbsp;<a href=\"http:\/\/www.ossec.net\/\">ossec<\/a>.<\/p>\n\n\n\n<p>You can download it from&nbsp;<a href=\"http:\/\/www.ossec.net\/files\/other\/ads_dump.exe\">here<\/a>&nbsp;and the source code (GPL v2) from&nbsp;<a href=\"http:\/\/www.ossec.net\/files\/other\/ads_dump.c\">here<\/a>.<\/p>\n\n\n\n<p>Using this tool is very simple, just execute it and pass as an argument the directory to scan. It is going to print every ADS found. Example:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">C:&gt;<strong>ads_dump.exe<\/strong>\nads_dump.exe dir\n\nC:&gt;<strong>echo hidden &gt; C:temp\/a:hidden<\/strong>\nC:&gt;<strong>echo hidden &gt; C:temp\/a:hidden2<\/strong>\nC:&gt;<strong>ads_dump.exe C:temp<\/strong>\nFound NTFS ADS: 'C:tempa:b'\nFound NTFS ADS: 'C:tempa:hidden'\nFound NTFS ADS: 'C:tempa:hidden2'\n<\/pre>\n\n\n\n<p>*Please note that it is still in beta (comments and suggestions are welcome). It will be also be included on the next version of ossec as part of the Windows anomaly detection module.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>ADS&nbsp;(Alternate Data Streams) is a \u201cfeature\u201d of the&nbsp;NTFS&nbsp;(file system used on Windows 2000, XP, etc) that permit files to be completely hidden from the system. You can read more about ADS in these two links:&nbsp;windowsecurity.com ADS&nbsp;and&nbsp;lads. Currently I am working on merging rootcheck (an anomaly detection module) to Windows and one of the things it [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3],"tags":[],"_links":{"self":[{"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/posts\/306"}],"collection":[{"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/comments?post=306"}],"version-history":[{"count":1,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/posts\/306\/revisions"}],"predecessor-version":[{"id":307,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/posts\/306\/revisions\/307"}],"wp:attachment":[{"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/media?parent=306"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/categories?post=306"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/defragged.org\/ossec\/wp-json\/wp\/v2\/tags?post=306"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}