alternate data streams and exclusions

[harryray2]

Would it be possible to have a column indicating that a file has an ADS and to be able to preview it?

Also, I know it can be done in the options menu but would it be poss to include in the temporary excludes system files and folders?

Thanks

[void]

Please try the Alternate Data Stream Count property:

• In Everything, right click the result list column header and click Add Columns....
• In the Select Property window, type in the following search:
  alternate
• Select Alternate Data Stream Count
• Click OK.

To search for files with an alternate data stream, search for:
alternate-data-stream-count:


Everything cannot know the format of the Alternate Data Stream data.
However, you can map Alternate Data Stream data to an Everything property with the property_alternate_data_stream_ansi, property_alternate_data_stream_utf8 and property_alternate_data_stream_wchar ini settings.

I recommend mapping to one of the custom properties.

I will add properties/columns to view the alternate data stream as ANSI, UTF-8, UTF-16 and as hex to avoid this mapping step in a future update.

ntfs_diz Alternate Data Stream to Everything Property

Also, I know it can be done in the options menu but would it be poss to include in the temporary excludes system files and folders?

Temporary Excludes are for filenames only.

Please try filters.
Please make sure attribute indexing is enabled under Tools -> Options -> Indexes.
Create a filter (from Search -> Add to filters) to search for:
!attrib:s

---note C:\Windows is not a ''system'' folder, please consider the following search:---
!attrib:s !C:\windows\

Filters can be activated from the Search menu, Filter bar (View -> Filters), right clicking the status bar, filter macro or filter keyboard shortcut.

[harryray2]

Thanks I'll try that for the ADS...at the moment I'm using the Nirsoft alternatedataview which does a decent job of it...

[harryray2]

I think that , for the moment anyway, the Nirsoft programme is a better option for me for viewing the ADS as it extracts the ADS data easily although I can still use Everything as well to search for files that have the streams

[jimspoon]

Since it is now possible to use Everything to search alternate data streams as void has described, I've been looking for ways to add alternate streams to files and edit them. It can be done using various command line methods but I haven't found many GUI options.

I did find such an option with Cudatext - https://cudatext.github.io/download.html

In Cudatext do the following:

Plugins > Addsons Manager > Install.
type "ntfs" in the search box, then click on the NTFS Streams plugin.
when the box pops up that says "Do you want to install it?", click OK.
After the plugin is installed, click Plugins > NTFS Streams.
Then you can click "Dialog for current file" or "Dialog for any file" (the latter will prompt you to pick a file).
A dialog will pop up with the following options:



From here it is easy to add a stream and then open it for editing, etc.

Another useful utility is ADS Manager - https://dmitrybrant.com/adsmanager - what is does is pretty clear from this screenshot:



Unlike Cudatext it does not provide any means of editing a stream but you can load the content of a file into a stream.

[harryray2]

Thanks..that quite a weird little programme, but it has the advantage of being able to write streams without having to resort to the command line.

I was looking for a programme that would add a tab to the Windows properties dialogue box, unfortunately the two I found were pre Vista and wouldn't run on Win 7.
I have found the Nirsoft alternatestreamview to be pretty good though for finding and viewing the streams.

[jimspoon]

Harry, are you able to view the contents of a stream from AlternateStreamView? There is the export function, but I don't want to have to export to a file then find and open the file. When I click the "Open Selected Stream With" command, nothing happens.

[harryray2]

Ill have a play with it but you're right...the open with doesn't seem to work.

There's also streamarmor but the results box is a mix of Hex and text.

[void]

Everything 1.5.0.1269a adds the following alternate data stream properties:

• Alternate Data Stream ANSI
• Alternate Data Stream UTF-8
• Alternate Data Stream UTF-16
• Alternate Data Stream UTF-16-BE
• Alternate Data Stream Text/Plain (Attempts to detect encoding as UTF-8, UTF-16, UTF-16BE or ANSI)
• Alternate Data Stream Hex (displays data with hexi-decimal values)

If there are multiple streams, each data value is separated with a semicolon (;)
If the data value contains a semicolon (;) or double quotes ("), the data is double quoted (").
double double quotes ("") are used to escape a single literal double quote (").

[harryray2]

Thanks for that, I'll try it out.

Gradually getting through my wish list :0)

[harryray2]

I think I'm being a bit dense here, is this just to show the stream names, it's not a preview of the stream?

I just read through your description properly..I now see it's not a preview. Sorry for the silly question :0)