NTFS Alternate Data Streams

What NTFS Alternate Data Streams Are

NTFS alternate data streams are a file system feature, not a separate storage layer. A file can carry one visible primary stream and one or more hidden named streams, which lets metadata or auxiliary content travel with the file while remaining attached to the same NTFS object.

Because the streams are part of the file record, they can preserve data in ways that are easy to miss in ordinary file browsing. That makes them useful for legitimate metadata, but it also means they can hide content from users and tools that only inspect the main file body.

How Alternate Data Streams Behave on NTFS

Streams are addressed by name, so the same filename can have multiple distinct data components behind it. The visible file is only the default stream; named streams are accessed explicitly and may not appear in common directory listings or simple copy operations.

This behaviour matters because a file’s apparent contents can differ from what is actually stored on disk. In practice, that can affect classification labels, forensic review, and any workflow that assumes a file is fully represented by its visible payload alone.

Why NTFS Alternate Data Streams Matter for Security

Alternate streams create a visibility gap. Security teams may scan, classify, or approve a file based on the primary stream while an additional stream still holds hidden instructions, notes, or metadata. If a process copies the file to another file system or to a tool that does not preserve streams, that attached data may disappear or be altered.

The security consequence is not that ADS are inherently malicious, but that they can be used to conceal data or to create mismatches between what is seen and what is retained. That is why file handling rules, transfer paths, and content inspection need to account for stream-preserving behaviour.

Detection, Preservation, and Forensic Review

Defenders typically look for alternate streams when they need to understand the full file state, verify whether metadata survived movement, or investigate suspicious file behaviour. Stream-aware tooling is important because ordinary file inspection may only show the default stream and miss everything else attached to the file.

Forensic review is especially relevant when a file has moved across systems or media. If the file was copied into a non-NTFS environment, the hidden stream may have been dropped, which changes both evidential value and operational meaning. The File System Forensics Guide covers the NTFS artefacts and checks that help expose this kind of behaviour.

When organisations use alternate streams for metadata, they should also treat the file itself as a carrier of security-relevant information. That is why scanning and inspection programs benefit from stream-aware handling, as described in the SCAP and Security Content Automation Guide, which discusses source data streams and compliance scanning workflows.

Practitioner Guidance

Why practitioners should care: NTFS alternate data streams can preserve important metadata, but they can also create blind spots when files are copied, scanned, or reviewed outside NTFS. Treat any workflow that relies on the visible file body alone as potentially incomplete.

What to watch for: Mismatches between file appearance and file behaviour, unexpected loss of metadata after transfer, and tools that do not explicitly report stream information are the usual warning signs. If a control label or other attached metadata is operationally important, verify that the destination file system and tooling preserve it.

Practitioner takeaway: Build file handling and inspection processes around the full object, not just the default stream, especially where provenance, classification, or evidence integrity matters.

Related resources from NHI Mgmt Group

• How should security teams reduce the risk of hidden NTFS alternate data streams in Windows environments?
• How do attackers use NTFS alternate data streams and how do you detect it?
• How do you detect execution from NTFS alternate data streams on Windows?
• Why do alternate data streams increase the chance of malware evading basic detection on Windows systems?