NTFS and ADS

[Rift]

**I havent posted much on the forum as of yet because of being busy coding and at work, so i thought id start by transfering posts from my section on the XT forum and putting them here.**


Im not sure how to start this off except i think that it's really neat. Have you ever wanted to hide something on your hard drive? or say on someone elses hard drive for say, program registration? and you want it so that they wont tamper with it? Here is an example of what im talking about and you can follow along succesfully with an NTFS formatted hard disc and some patience.

go into DOS prompt
(click start > Run > Type in: cmd)

while in dos type:
cd \
this should put you in your root directory
next type mkdir Test
a new folder named Test will be made under C:\

now type: cd Test

from there type:

echo "Some Information" > :Info.txt

now type: DIR

you should see that somehow your directory is still empty, this isnt the case however. you can see the contents of :Info.txt by typing

more < :Info.txt

you should now see the information you placed in :info.txt

you can also attach these "files" to other files on the computer, this will not alter the other files in any visible way, including the size or appearance, however it will change the "modified" date on the properties listing for the file, this can be accomplished as follows

in your Test2 folder copy the file calc.exe into Test2, this can be done by typing the following:

copy C:&#092;windows&#092;system32&#092;calc.exe C:&#092;Test2&#092;calc.exe

Once the calc.exe is in your Test2 directory type the following:

type calc.exe > .&#092;readme.txt.exe

"include the word type"

now type the following:

start .&#092;readme.txt.exe

you should now see calculator facing you. this is because it is now known as d.exe in the ADS. If you check under process's you will see readme.txt.exe, however under applications you will only see Calculator.

The funny thing is, if you delete calculator.exe, you can still use the:
start .&#092;readme.txt.exe to run calculator, even if you delete it > this is the same for any exe you may attach, any exe, wav, avi, any file at all actualy. mal or harmless.
this is a good way to hide many files, and not only to hide, but attatch to any file, and then once your attached you can delete the file you've attached and it will still be able to be ran. > i hope that all made sense, or at least most of it, if you have any more questions just post em

-Rift-


btw i figured out how to read the files through VB by using some windows API that works like the dos prompt.