What is nTFS?

What non-malicious uses of alternate data streams in NTFS exist?

• Reading up on NTFS and ADS, it seems this function of NTFS is rather dangerous, and doesn't have many good uses. What uses does it have?

• Answer:

  ADS is intended to provide compatibility to Apple's Macintosh Hierarchical File System in case Apple programs need to access files stored on a Windows server. However Microsoft provides APIs to access this feature, so any application can access ADS whenever the developer sees a use for it. Many applications treat files as a single stream, therefore the ADS data is lost easily (e.g. there is no easy way to spread the file via the internet as protocols like HTTP/FTP etc are usually not aware of the stream). Every file backup program for Windows is supposed to be able to back up the ADS if the backup destination supports the feature. Before Vista, ADS is used by Windows Explorer when you enter summary information for a file, if the file format has no way to save metadata within itself. It is also used by column/property handlers or index search filters to store file metadata (e.g. ADS is added when Windows Indexes .eml files). It is also used to store resource properties in Active Directory and sometimes used by IIS to store WebDAV Properties. ADS is used by Windows attachment manager to store the original security zone. That's why you sometimes will get warning when you open a file downloaded from internet from applications that are http://support.microsoft.com/kb/883260(e.g. Windows Explorer, IE, FireFox, Google Chrome, Outlook, WinZip, or any other application that care to check or set the zone identifier) . ADS is used by Windows File Server Resource Manager to classify files with high risk that should not go to the wrong hands. It is also used by Windows Encrypting File System to store file securely. ADS is used by SQL Server Database Consistency Checker to maintain database integrity. ADS is used by Kaspersky Anti-Virus and CA's ETrust Anti-virus to improve scanning performance. ADS is used by Citrix's Citrix Virtual Memory Optimization service to speed up DLL loading.