ADS Usage
Information Only Last Reviewed: 2009-12-10
Revision: 4.2 – Released: 2006-11-21 Windows: NT, 2000, XP
“Alternate data streams are strictly a feature of the NTFS file system and may not be supported in future file systems. However, NTFS will be supported in future versions of Windows NT. Future file systems will support a model based on OLE 2.0 structured storage (IStream and IStorage). By using OLE 2.0, an application can support multiple streams on any file system and all supported operating systems (Windows, Macintosh, Windows NT, and Win32s), not just Windows NT
Anchor Link AlternateStreamView
License: Freeware Last Reviewed: 2012-10-29
Version: 1.35 – Released: 2012-10-28 Windows: 2000 and up to Windows 8
File Size: 47 KB
“AlternateStreamView is a small utility that allows you to scan your NTFS drive, and find all hidden alternate streams stored in the file system. After scanning and finding the alternate streams, you can extract these streams into the specified folder, delete unwanted streams, or save the streams list into text/html/csv/xml file.”
Anchor Link Boot Sector Recovery
Information Only Last Reviewed: 2009-07-04
Revision: 2.2 – Released: 2007-02-21 Windows: NT, 2000
“When a volume on a server or workstation becomes inaccessible or Disk Administrator shows it as unknown, you may have a corrupt or damaged boot sector. This article will tell you how to find the second copy that NTFS stores and restore to the correct position on the disk.”
Anchor Link Choosing Between File Systems
Information Only Last Reviewed: 2012-05-29
Published: 1999-10-15 Windows: 2000, XP
“If you’re new to Microsoft Windows, you may not completely understand the intricacies of the various types of file systems. As you may have heard, there are times when it’s appropriate to use the FAT file system, other times when it’s more appropriate to use NTFS, and still other times when you’ll want to use FAT32. In this article, I’ll discuss the differences between these file systems and explain how to gain the maximum benefit from them.”
Anchor Link Date and Time Stamps
Information Only Last Reviewed: 2009-07-04
Revision: 3.3 – Released: 2007-02-28 Windows: NT, 2000
“This article describes how file and folder date and time stamps (created or modified) are displayed based on the file system that is in use (FAT or the NTFS file system), and the partition (whether the action occurred on the same partition or across partitions).”
Anchor Link Default Cluster Sizes
Information Only Last Reviewed: 2012-08-08
Revision: 9.0 – Released: 2012-08-08 Windows: 2000, XP, 2003, Vista, 2008, 7
“All file systems used by Windows organize your hard disk based upon cluster (or allocation unit) size, which represents the smallest amount of disk space which can be allocated to hold a file. So when file sizes do not come out to an even multiple of the cluster size, extra space must be used to hold the file (up to the next multiple of the cluster size). On the typical partition, this means that (cluster size)/2 * (number of files) worth of space is lost this way. If no cluster size is specified during format, NTFS picks defaults based upon the size of the partition. These defaults have been selected to reduce the amount of space lost and to reduce the amount of fragmentation on the partition.”
Anchor Link Disk Space Problems
Information Only Last Reviewed: 2009-10-29
Revision: 4.0 – Released: 2009-10-29 Windows: XP
“This article describes how to check NTFS disk space allocation to either discover offending files and folders or locate volume corruption. This article is intended for users of Windows XP operating systems that support advanced storage features and troubleshooting methods.
“For a Microsoft Windows 2000 version of this article, see KB 303079.”
Anchor Link FAT16 or FAT32 Conversion
Information Only Last Reviewed: 2010-03-03
Revision: 5.6 – Revised: 2010-03-03 Windows: XP
“Windows XP supports three file systems for fixed disks: FAT16, FAT32, and NTFS. It is recommended that you use NTFS with Windows XP because of its advanced performance, security, and reliability features. This article describes how to convert a FAT16 or FAT32 volume to NTFS.”
Anchor Link File Or Folder Deletion
Information Only Last Reviewed: 2010-03-03
Revision: 7.6 – Revised: 2010-03-03 Windows: 2000, XP, 2003
“This article describes why you may not be able to delete a file or a folder on an NTFS volume and how to address the different causes to resolve this issue.”
Anchor Link General NTFS Information
Information Only Last Reviewed: 2009-07-04
Windows: 2000, XP, 2003, Vista, 2008, 7
“NTFS is a high-performance and self-healing file system proprietary to Windows XP, 2000, NT, which supports file-level security, compression and auditing. It also supports large volumes and powerful storage solution such as RAID. The most important new feature of NTFS is the ability to encrypt files and folders to protect your sensitive data.”
Anchor Link Hard Link Shell Extension
License: Freeware Last Reviewed: 2013-04-06
Version: 3.7.4.8 – Released: 2013-04-05 Windows: 2000, XP, 2003, Vista, 2008, 7, 8
File Size: 3.4 MB Both 32- and 64-bit versions
“The NTFS file system implemented in NT4, Windows 2000, Windows XP, Windows XP-64, and Windows7/8 supports a facility known as hard links (referred to herein as HardLinks). HardLinks provide the ability to keep a single copy of a file yet have it appear in multiple folders (directories). They can be created with the POSIX command ln included in the Windows Resource Kit or the fsutil command utility included in Windows XP. Thus, using standard Windows facilities HardLinks can only be created at the command prompt, which can be tedious, especially when HardLinks to multiple files are required or when one only makes occasional use of HardLinks. Support for Junctions in standard Microsoft software offerings is even more limited than that offered for HardLinks.
“Link Shell Extension (LSE) provides for the creation of HardLinks , Junctions , and Vista’s Symbolic Links, (herein referred to collectively as Links) and a Folder Cloning process that utilises HardLinks or Symbolic Links. LSE, as its name implies is implemented as a Shell extension and is accessed from Windows Explorer, or similar file/folder managers. The extension allows the user to select one or many files or folders, then using the mouse, complete the creation of the required Links – HardLinks, Junctions or Symbolic Links or in the case of folders to create Clones consisting of Hard or Symbolic Links. LSE is supported on all Windows versions that support NTFS version 5.0 or later, including Windows XP-64 and the upcoming Vista operating system. HardLinks, Junctions and Symbolic Links are NOT supported on FAT file systems, and nor is the Cloning process supported on FAT file systems.”
Anchor Link Junction
License: Freeware Last Reviewed: 2012-02-21
Version: 1.06 – Released: 2010-09-08 Windows: XP and higher
File Size: 77.7 KB
“Windows 2000 and higher supports directory symbolic links, where a directory serves as a symbolic link to another directory on the computer. For example, if the directory D:\SYMLINK specified C:\WINNT\SYSTEM32 as its target, then an application accessing D:\SYMLINK\DRIVERS would in reality be accessing C:\WINNT\SYSTEM32\DRIVERS. Directory symbolic links are known as NTFS junctions in Windows. Unfortunately, Windows comes with no tools for creating junctions you have to purchase the Win2K Resource Kit, which comes with the linkd program for creating junctions. I therefore decided to write my own junction-creating tool: Junction. Junction not only allows you to create NTFS junctions, it allows you to see if files or directories are actually reparse points. Reparse points are the mechanism on which NTFS junctions are based, and they are used by Windows’ Remote Storage Service (RSS), as well as volume mount points.”
Anchor Link Junction Link Magic
License: Freeware Last Reviewed: 2009-07-04
Version: 1.0.2 – Released: 2004-01-04 Windows: 2000, XP, 2003, Vista
File Size: 602 KB
“Junction Link Magic is a utility that lets you create junction points with Windows 2000, XP, 2003, or Vista. Junction Link Magic automatically lists existing junction points, and it offers you an easy interface to add, modify or remove junction points.
“A junction point (also known as a reparse point) is a technology for a folder to be grafted into another folder on the same local computer. Junction points are transparent to programs. This might not seem like a big deal, but it can remove a lot of clutter. It also helps a lot when moving programs from one place to another, since just about every program in the Windows world expects to never be moved from the directory it was installed in. E.g., moving your ‘Program Files’ directory contents to another drive, and linking the original ‘Program Files’ directory to this new location. With junction points you can also surpass the 26 drive letter limitation. Junction points can only be created on volumes formatted with NTFS 5.0 or higher. NTFS 5.0 is supported in Windows 2000, Windows XP and higher.”
Anchor Link List Alternate Data Streams
License: Freeware Last Reviewed: 2009-05-25
Version: 4.10 – Released: 2007-01-04 Windows: NT4, 2000, XP, 2003, Vista
File Size: 35 KB
“As its name suggests, this program lists all alternate data streams of an NTFS directory. It shows also the ADS of encrypted files, even when these files were encrypted with another copy of Windows 2000. There are also options to walk through subdirectories recursively and to show the sum of the bytes used.”
Anchor Link Master File Table
Information Only Last Reviewed: 2009-07-04
Revision: 6.1 – Released: 2008-10-16 Windows: NT, 2000, XP, 2003
How NTFS Reserves Space for its Master File Table
“The NTFS file system contains at its core, a file called the master file table (MFT). There is at least one entry in the MFT for every file on an NTFS volume, including the MFT itself. Because utilities that defragment NTFS volumes cannot move MFT entries, and because excessive fragmentation of the MFT can impact performance, NTFS reserves space for the MFT in an effort to keep the MFT as contiguous as possible as it grows.
“In Windows XP and in Windows Server 2003, the defrag utility defrags the MFT. A defrag operation on the MFT combines an MFT file into 1 and prevents it from being stored in multiple places that are not sequential on disk. In this class of operation, the MFT file is more sequential. However, it is exactly the size that the MFT file was before the defrag operation.
“An MFT can be too big if a volume used to have lots of files that were deleted. The files that were deleted cause internal holes in the MFT. These holes are significant regions that are unused by files. It is impossible to reclaim this space. This is at least true on a live NTFS volume.”
Anchor Link New Technology File System
Information Only Last Reviewed: 2009-07-04
Author: Charles M. Kozierok
“… while FAT is acceptable for most uses, it is also a very old, limited and relatively simplistic file system. It has few of the security, capacity and reliability features that are needed by high-end users, and especially, servers and workstations in a corporate networking environment. In this section, I provide a fairly comprehensive description of the key characteristics of the New Technology File System (NTFS). I begin with an overview and history of the NTFS file system, and a discussion of the different versions of NTFS. I then describe NTFS’s architecture and major structures, and explain how directories and files are organized in NTFS. I then move on to discuss NTFS’s security and permissions system, and then several reliability and management features associated with the file system. I then describe some of the ‘additional’ features associated with certain versions of NTFS, and conclude with a discussion of various NTFS implementation issues.”
Anchor Link NTFS Conversion
Information Only Last Reviewed: 2009-01-15
Revision: 1.5 – Released: 2007-10-29 Windows: XP
“Windows XP supports two disk file systems: the file allocation table (FAT) file system and the NTFS file system. This article explains how to convert a FAT partition into an NTFS partition and discusses the considerations that you must take into account.
“Windows XP includes the Convert.exe utility for converting a FAT partition to an NTFS partition. Convert.exe is simple to use, but there are some limitations that you should consider before using the utility.
“For a Microsoft Windows 2000 version of this article, see KB 214579.”
Anchor Link NTFS System Files
Information Only Last Reviewed: 2009-07-04
“NTFS includes several system files, all of which are hidden from view on the NTFS volume. A system file is one used by the file system to store its metadata and to implement the file system. System files are placed on the volume by the ‘Format’ utility.”
Anchor Link Streams
License: Freeware – Source included Last Reviewed: 2010-04-01
Version: 1.56 – Released: 2007-04-27 Windows: NT, 2000, XP
File Size: 46 KB
“The NTFS file system provides applications the ability to create alternate data streams of information. NT does not come with any tools that let you see which NTFS files have streams associated with them, so I’ve written one myself.
“Streams will examine the files and directories (note that directories can also have alternate data streams) you specify and inform you of the name and sizes of any named streams it encounters within those files. Streams makes use of an undocumented native function for retrieving file stream information. Full source code is included.”
Anchor Link What You Should Know
Information Only Last Reviewed: 2011-01-10
Windows: 3.1, 3.5, 4.0, 2000, XP
“What is an Alternate Data Stream? Simply put, it’s the ability to hide data behind a file, such as text, graphics or executable code (games, trojans, etc).
“For example: You could have a small text file (hello.txt of say 1k in size) – however, attached to it is an executable program that is 5 megs in size. When you do a directory listing (look for files on your pc), the system will show you a small 1k text file without revealing the 5 meg file. Malicious users take advantage of this by storing a virus or trojan on your system. Employees can abuse this by hiding graphics or data behind text files, etc.”