This post provides various command-line methods of creating, referencing, extracting and deleting NTFS alternate data streams. The PowerShell script was originally intended to delete NTFS attributes other than $data, but I don't think this is possible using DeleteFile from Kernel32.
The PowerShell script is really just a wrapper around a simple call to DeleteFile in VB.Net, using the syntax %file%:%stream%:%Attribute, eg test.txt:stream1:$DATA
Included below the script are methods to create streams using echo and type in files and directory objects, run executable code from an alternate stream, and display detail on the streams using nfi.exe and streams.exe.
# Delete an NTFS alternate data stream for the specified file
# Wayne Martin, 22/06/2008, http://waynes-world-it.blogspot.com/
# powershell . .\DeleteNTFSStream.ps1 -f "d:\temp\test.txt" -a "`$Data" -s "stream1"
# Accessing alternative data-streams of files on an NTFS volume
$provider = new-object Microsoft.VisualBasic.VBCodeProvider
$params = new-object System.CodeDom.Compiler.CompilerParameters
$params.GenerateInMemory = $True
$refs = "System.dll","Microsoft.VisualBasic.dll"
$VBCode = @'
'''Return Type: BOOL->int
Add a string to a stream $Data attribute:
echo this content will be stored in the file sub stream > test.txt:stream1
Add the contents of a file to an alternate data strem
type file.txt > test.txt:stream1
Create a new file in an alternate stream as part of a directory:
md test & echo alternate stream > test:stream1
Display the stream:
more < test.txt:stream1
Display the NTFS attributes for the file
NTFS File Sector Information Utility.
Copyright (C) Microsoft Corporation 1999. All rights reserved.
$DATA stream1 (resident)
Add an executable as an alternate stream (the stream is attached to a directory in this case)
type c:\windows\system32\notepad.exe > test:test.exe
Run the executable in the alternate stream
cmd /c start .\test:test.exe
View the directory and its alternate stream containing notepad.exe
$DATA test.exe (nonresident)
logical sectors 659144-659151 (0xa0ec8-0xa0ecf)
logical sectors 660312-660319 (0xa1358-0xa135f)
logical sectors 646776-646791 (0x9de78-0x9de87)
logical sectors 701064-701095 (0xab288-0xab2a7)
logical sectors 5101080-5101143 (0x4dd618-0x4dd657)
logical sectors 27656944-27656951 (0x1a602f0-0x1a602f7)
$INDEX_ROOT $I30 (resident)
$INDEX_ALLOCATION $I30 (nonresident)
logical sectors 11436456-11436463 (0xae81a8-0xae81af)
$BITMAP $I30 (resident)
Retrieve the binary file from the stream and store in the default stream of a new file (using win32 port of Unix Cat)
cat test:test.exe > note.exe
Remove a stream (does not maintain timestamps)
Delete an alternate data stream
streams -d test.txt
nfi.exe, part of OEM Support Tools Phase 3 Service Release 2 Availability
Accessing alternative data-streams of files on an NTFS volume
Find and delete NTFS Alternate Data Streams (ADS)
How To Use NTFS Alternate Data Streams
Practical Guide to Alternative Data Streams in NTFS
Viewing NTFS information with nfi and diskedit
Wayne's World of IT (WWoIT), Copyright 2008 Wayne Martin.