tag:blogger.com,1999:blog-20977280.post115517801985625778..comments2023-05-12T04:45:20.579-05:00Comments on My Green Paste, Inc.: NTFS Alternate Data Streams«/\/\Ø|ö±ò\/»®©http://www.blogger.com/profile/04886149439479604072noreply@blogger.comBlogger4125tag:blogger.com,1999:blog-20977280.post-90627563576900897592010-01-11T08:58:06.159-06:002010-01-11T08:58:06.159-06:00The {4c8cc155-6c1e-11d1-8e41-00c04fb9386d} ADS is ...The {4c8cc155-6c1e-11d1-8e41-00c04fb9386d} ADS is used for some "meta" information when the OS creates another ADS, for example thumbnails or file Summary Properties.<br /><br />http://msdn.microsoft.com/en-us/library/dd942525(PROT.10).aspxTony Byenoreply@blogger.comtag:blogger.com,1999:blog-20977280.post-76790079053309596492009-05-28T18:02:20.948-05:002009-05-28T18:02:20.948-05:00If you want to copy the stream to a new file, use ...If you want to copy the stream to a new file, use this at the command prompt:<br /><br />C:\>more < hasStream.dat:strmname > streamFile.dat<br /><br />Now you can examine it independently of the source file with a Hex Editor, etc.Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-20977280.post-51305017542412257352007-05-02T21:58:00.000-05:002007-05-02T21:58:00.000-05:00Hi Martin,I checked out the article you referenced...Hi Martin,<BR/><BR/>I checked out the article you referenced.<BR/><BR/>One can remove a named stream from a file without deleting the parent file, if the program / utility used is ADS-aware - the <A HREF="http://msdn2.microsoft.com/en-us/library/aa363915.aspx" REL="nofollow">DeleteFile</A> API is capable of doing this. Sadly, I'm not aware of anything that ships with an OS that fits the bill, which leads one to the method of copying the unnamed stream to another file, deleting the file with the undesirable named stream, and renaming the file that had the original unnamed stream to the desired name:<BR/><BR/>cat hasStream.jpg > save.jpg<BR/>del hasStream.jpg<BR/>ren save.jpg goodfile.jpg<BR/><BR/>This doesn't appear to work on named streams attached to directories, though DeleteFile will still remove these.«/\/\Ø|ö±ò\/»®©https://www.blogger.com/profile/04886149439479604072noreply@blogger.comtag:blogger.com,1999:blog-20977280.post-48889153976336674232007-05-02T12:33:00.000-05:002007-05-02T12:33:00.000-05:00Maybe my small article about ADS interests you:htt...Maybe my small article about ADS interests you:<BR/>http://www.martinlos.com/?p=11Anonymousnoreply@blogger.com