1

I was playing around with NTFS ADS and found out that I cannot use any of them on the . and .. folders

I tried:

  • ..:$I30:$INDEX_ALLOCATION
  • ..::$INDEX_ALLOCATION
  • ..::$INDEX_ROOT
  • ..:$DATA

does anyone have any insight as to why that is? is there any way around that?

Thanks

Boaz Sharabi
  • 11
  • 1

3 Answers3

0

. and .. are not real folders, just symbols for "this folder" or "the parent folder", so of course you can't attach an ADS to them.

ths
  • 2,858
  • 1
  • 16
  • 21
  • I would expect the stream to be attached to the real folders they point to... also, do you have any information as to what those folders really are? cant seems to find any useful data on the subject – Boaz Sharabi Sep 11 '14 at 12:44
0

Adding to what ths wrote, that . and .. are special symbols representing the current and parent folders respectively, if you write to an ADS of a folder (e.g. echo 123 > myfolder:streamname), then running dir /r inside myfolder will show you that .:streamname:$DATA exists, and running dir /r from a subfolder of myfolder will show ..:streamname:$DATA similarly.

The $INDEX_ALLOCATION attribute type is the one for folders (e.g. echo 123 > newfolder::$INDEX_ALLOCATION), and can be used to create folders, but you can't simply echo some data into it (internally NTFS stores the data of the directory inside it).

echo 123 > :streamname:$DATA will write it into ., and it will also be visible from the parent directory.

Eran Zimmerman Gonen
  • 4,375
  • 1
  • 19
  • 31
  • When I try echo 123 > myfolder:streamname as you suggested, I get an error "Access denied". Do you have any idea? Programmatically also I am unable to open a folder using CreateFile() api to add ADS. It works on files though. – Gautam Jain Jul 19 '22 at 12:22
  • Maybe the user you're using doesn't have write permissions to the folder, or some other permission issue? Try creating a folder yourself in a writable location (e.g. %TMP%), and adding ADS to that folder. – Eran Zimmerman Gonen Jul 31 '22 at 12:11
  • Thanks Eran. Yes, I was trying the default "Downloads" folder which has permission issue. Then I tried another custom folder, after which it worked. – Gautam Jain Aug 01 '22 at 13:03
0

Creating a directory with Streams needs two steps:

1.Create the Directory:

mkdir J:\ads-test:$I30:$INDEX_ALLOCATION

2.Create a Stream for this Directory:

echo xyz > ads-test:StreamName:$DATA

Now you can list and see the directory stream-

J:\>dir /R
07/20/2022  03:49 PM    <DIR>          ads-test
                                 6 ads-test:StreamName:$DATA
Igal Katzir
  • 1
  • 1