(pronounced as separate letters) Short for alternate data stream, a function of Microsoft’s NTFS file system in which files can be embedded in other files and are invisible to the user through Windows Explorer (i.e., the ADS does not affect the size, function or display of the main file the ADS is attached to). While ADS files (which are well known throughout the hacker community) can be used maliciously by an attacker wishing to plant an executable file into another file without it being detected, ADS also is used legitimately by programmers. For example, an antivirus program can include a checksum value in an ADS attached to each file.
Microsoft originally included the ADS function in NTFS in order to ensure file server compatibility with the Macintoshhierarchical file system in which files are forked.
Hidden Threat: Alternate Data Streams A relatively unknown compatibility feature of NTFS, ADS provides hackers with a method of hiding root kits or hacker tools on a breached system and allows them to be executed without being detected by the systems administrator.
White Papers
