ADS: Protecting NTFS from hacking

Alternate Data Streams is one of the possible ways to hide data in NTFS file system in Windows. It was introduced to make Windows NTFS compatible with HFS file system of Macintosh. This paper explains what exactly alternate data streams are, their requirement and their functionality. It also explains whether alternate data streams is a feature or a vulnerability of NTFS file system. It explains how hacker can utilize this functionality of NTFS to hide malicious codes in victim's machine so as to compromise it. All possible ways of hiding data and techniques for detecting and removing ADS are also explained. It mainly focuses on criminals who use various data hiding techniques in order to hide their data from the forensic analysts. Finally its main focus is on explaining an ADS Tool that is a graphical tool which enables user to create, start, detect and delete ADS.