{"id":1349,"date":"2012-10-04T14:08:21","date_gmt":"2012-10-04T14:08:21","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=1349"},"modified":"2012-10-04T15:46:31","modified_gmt":"2012-10-04T15:46:31","slug":"finding-alternate-data-streams-ads-with-hmft","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2012\/10\/04\/finding-alternate-data-streams-ads-with-hmft\/","title":{"rendered":"Finding Alternate Data Streams (ADS) with HMFT"},"content":{"rendered":"<p>Finding Alternate Data Streams\u00a0 (ADS) on the whole drive may be quite time consuming so in this quick post I will show you how to do it faster with HMFT.<\/p>\n<p>As you probably <a title=\"HMFT update: listing $MFT attributes\" href=\"https:\/\/www.hexacorn.com\/blog\/2012\/09\/29\/hmft-update-listing-mft-attributes\/\">know<\/a>, the latest version of HMFT supports listing of basic attributes directly from $MFT &#8211; from both images and live systems. Amongst the features it currently supports is showing type of attribute and its name. Turns out, that this is enough information to find out what named DATA streams are hidden inside the FILE records &#8211; and this is essentially what ADSs are.<\/p>\n<p>So&#8230;<\/p>\n<p>First, let&#8217;s test how HMFT shows ADS-related data:<\/p>\n<ul>\n<li>First let&#8217;s create a few sample ADSs<\/li>\n<\/ul>\n<pre style=\"padding-left: 60px;\">echo &gt; f:\\test\r\necho &gt; f:\\test:ads\r\necho &gt; f:\\test:ads2\r\necho &gt; f:\\test:ads3<\/pre>\n<ul>\n<li>Next, we run hmft over the drive and saving it to a file<\/li>\n<\/ul>\n<pre style=\"padding-left: 60px;\">hmft -l f: f_mft.txt<\/pre>\n<ul>\n<li>Finally, let&#8217;s see the content of the file &#8211; scroll down to see file name, first unnamed DATA attribute that is then followed by 3 named DATA attributes &#8211; ADS names:<\/li>\n<\/ul>\n<pre style=\"padding-left: 60px;\">  [FILE]\r\n    SignatureD                    = 1162627398\r\n    OffsetToFixupArrayW           = 48\r\n    NumberOfEntriesInFixupArrayW  = 3\r\n    LogFileSequenceNumberQ        = 4204637\r\n    SequenceValueW                = 1\r\n    LinkCountW                    = 1\r\n    OffsetToFirstAttributeW       = 56\r\n    FlagsW                        = 1\r\n    UsedSizeOfMFTEntryD           = 448\r\n    AllocatedSizeOfMFTEntryD      = 1024\r\n    FileReferenceToBaseRecordQ    = 0\r\n    NextAttributeIdD              = 6\r\n   --\r\n\r\n    RESIDENT ATTRIBUTE\r\n      AttributeTypeIdentifierD = 16\r\n      LengthOfAttributeD       = 96\r\n      NonResidentFlagB         = 0\r\n      LengthOfNameB            = 0\r\n      OffsetToNameW            = 0\r\n      FlagsW                   = 0\r\n      AttributeIdentifierW     = 0\r\n      --\r\n      SizeOfContentD          = 72\r\n      OffsetToContentW        = 24\r\n      --\r\n        MFTA_STANDARD_INFORMATION\r\n            CreationTimeQ         = 129938289425003390\r\n            ModificationTimeQ     = 129938289502223390\r\n            MFTModificationTimeQ  = 129938289502223390\r\n            AccessTimeQ           = 129938289425003390\r\n            FlagsD                = 32\r\n            MaxNumOfVersionsD     = 0\r\n            VersionNumberD        = 0\r\n            ClassIdD              = 0\r\n            OwnerIdD              = 0\r\n            SecurityIdD           = 261\r\n            QuotaQ                = 0\r\n            USNQ                  = 0\r\n            CreationTime (epoch)    = 1349355342\r\n            ModificationTime (epoch)  = 1349355350\r\n            MFTModificationTime (epoch)  = 1349355350\r\n            AccessTime (epoch)           = 1349355342\r\n   --\r\n\r\n    RESIDENT ATTRIBUTE\r\n      AttributeTypeIdentifierD = 48\r\n      LengthOfAttributeD       = 104\r\n      NonResidentFlagB         = 0\r\n      LengthOfNameB            = 0\r\n      OffsetToNameW            = 0\r\n      FlagsW                   = 0\r\n      AttributeIdentifierW     = 2\r\n      --\r\n      SizeOfContentD          = 74\r\n      OffsetToContentW        = 24\r\n      --\r\n        MFTA_FILE_NAME\r\n            ParentID6             = 5\r\n            ParentUseIndexW       = 5\r\n            CreationTimeQ         = 129938289425003390\r\n            ModificationTimeQ     = 129938289425003390\r\n            MFTModificationTimeQ  = 129938289425003390\r\n            AccessTimeQ           = 129938289425003390\r\n            CreationTime (epoch)    = 1349355342\r\n            ModificationTime (epoch)  = 1349355342\r\n            MFTModificationTime (epoch)  = 1349355342\r\n            AccessTime (epoch)           = 1349355342\r\n            AllocatedSizeQ        = 0\r\n            RealSizeQ             = 0\r\n            FlagsD                = 32\r\n            ReparseValueD         = 0\r\n            LengthOfNameB         = 4\r\n            NameSpaceB            = 3\r\n     <strong>FileName<\/strong> = <strong><span style=\"color: #ff0000;\">test<\/span><\/strong>\r\n   --\r\n\r\n    RESIDENT ATTRIBUTE\r\n      AttributeTypeIdentifierD = 128\r\n      LengthOfAttributeD       = 40\r\n      NonResidentFlagB         = 0\r\n      LengthOfNameB            = 0\r\n      OffsetToNameW            = 24\r\n      FlagsW                   = 0\r\n      AttributeIdentifierW     = 1\r\n      --\r\n      SizeOfContentD          = 13\r\n      OffsetToContentW        = 24\r\n      --\r\n        <strong>MFTA_DATA<\/strong>\r\n   --\r\n\r\n    RESIDENT ATTRIBUTE\r\n      AttributeTypeIdentifierD = 128\r\n      LengthOfAttributeD       = 48\r\n      NonResidentFlagB         = 0\r\n      LengthOfNameB            = 3\r\n      OffsetToNameW            = 24\r\n      FlagsW                   = 0\r\n      AttributeIdentifierW     = 3\r\n      --\r\n      SizeOfContentD          = 13\r\n      OffsetToContentW        = 32\r\n      --\r\n        <strong>MFTA_DATA<\/strong>\r\n    <strong>AttributeName<\/strong> = <strong><span style=\"color: #ff0000;\">ads<\/span><\/strong>\r\n   --\r\n\r\n    RESIDENT ATTRIBUTE\r\n      AttributeTypeIdentifierD = 128\r\n      LengthOfAttributeD       = 48\r\n      NonResidentFlagB         = 0\r\n      LengthOfNameB            = 4\r\n      OffsetToNameW            = 24\r\n      FlagsW                   = 0\r\n      AttributeIdentifierW     = 4\r\n      --\r\n      SizeOfContentD          = 13\r\n      OffsetToContentW        = 32\r\n      --\r\n        <strong>MFTA_DATA<\/strong>\r\n    <strong>AttributeName<\/strong> = <strong><span style=\"color: #ff0000;\">ads2<\/span><\/strong>\r\n   --\r\n\r\n    RESIDENT ATTRIBUTE\r\n      AttributeTypeIdentifierD = 128\r\n      LengthOfAttributeD       = 48\r\n      NonResidentFlagB         = 0\r\n      LengthOfNameB            = 4\r\n      OffsetToNameW            = 24\r\n      FlagsW                   = 0\r\n      AttributeIdentifierW     = 5\r\n      --\r\n      SizeOfContentD          = 13\r\n      OffsetToContentW        = 32\r\n      --\r\n        <strong>MFTA_DATA<\/strong>\r\n    <strong>AttributeName<\/strong> = <strong><span style=\"color: #ff0000;\">ads3<\/span><\/strong><\/pre>\n<p>&nbsp;<\/p>\n<ul>\n<li>Knowing all this, we can quickly put together a perl script that can walk through the data and pick up all ADS from the output file:<\/li>\n<\/ul>\n<pre style=\"padding-left: 60px;\">use strict;\r\nmy $f='';\r\nmy $l='';\r\nwhile (&lt;&gt;)\r\n{\r\n\u00a0 s\/[\\r\\n]+\/\/g;\r\n\u00a0 $f = $1 if \/FileName = (.+)$\/;\r\n\u00a0 print \"$f:$1\\n\" if ($l =~ \/MFTA_DATA\/&amp;&amp;\/AttributeName = (.+)$\/);\r\n\u00a0 $l = $_;\r\n}<\/pre>\n<ul>\n<li>Save it as <strong>ads.pl<\/strong><\/li>\n<li>Run it using the following syntax<\/li>\n<\/ul>\n<pre style=\"padding-left: 90px;\">perl ads.pl &lt;hmft output&gt;<\/pre>\n<p style=\"padding-left: 60px;\">e.g.:<\/p>\n<pre style=\"padding-left: 90px;\">perl ads.pl f_mft.txt<\/pre>\n<p>The output for the example file system is:<\/p>\n<pre style=\"padding-left: 30px;\">$Repair:$Config\r\ntest:ads\r\ntest:ads2\r\ntest:ads3<\/pre>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2012\/10\/HMFT_finding_ADS_1.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-medium wp-image-1351\" title=\"HMFT_finding_ADS_1\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2012\/10\/HMFT_finding_ADS_1-300x202.png\" alt=\"\" width=\"300\" height=\"202\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2012\/10\/HMFT_finding_ADS_1-300x202.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2012\/10\/HMFT_finding_ADS_1.png 581w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>I suggest you running a test on your local drives\u00a0 &#8211; you are probably going to be quite surprised \ud83d\ude42<\/p>\n<p>Not only you may find plenty of files with ADS, but you may also get to know less-known good ADSs &#8211; many of them I have listed <a title=\"Good Alternate Data Streams (ADS)\" href=\"https:\/\/www.hexacorn.com\/blog\/2012\/03\/26\/good-alternate-data-streams-ads\/\">previously<\/a> and a few more e.g. internal ADSs used by OS:<\/p>\n<ul>\n<li>$Info in $UpCase:$Info<\/li>\n<li>$Config in $Repair:$Config<\/li>\n<li>$Max in $UsnJrnl:$Max<\/li>\n<\/ul>\n<p>and also MAC-related streams (resource forks) added by Safari\u00a0 (kinda equivalents of IE&#8217;s Zone.Identifier)<\/p>\n<ul>\n<li>com.apple.quarantine<\/li>\n<li>com.apple.metadata:kMDItemWhereFroms<\/li>\n<\/ul>\n<p>Note on a small bug here: with a larger number of ADSs the ads.pl script will show incorrect entries as ADS attributes that don&#8217;t fit within one FILE record will be stored elsewhere and w\/o FILENAME attribute, hence the associated file name will be incorrect. Some may be also stored under ATTRIBUTE_LIST that is not supported by HMFT yet.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Finding Alternate Data Streams\u00a0 (ADS) on the whole drive may be quite time consuming so in this quick post I will show you how to do it faster with HMFT. As you probably know, the latest version of HMFT supports &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2012\/10\/04\/finding-alternate-data-streams-ads-with-hmft\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[15,19,20,9,16],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/1349"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=1349"}],"version-history":[{"count":12,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/1349\/revisions"}],"predecessor-version":[{"id":1356,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/1349\/revisions\/1356"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=1349"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=1349"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=1349"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}