Skip to content

Instantly share code, notes, and snippets.

View tothandor's full-sized avatar

Andor tothandor

0 followers · 2 following
  • Budapest
  • 17:28 (UTC +01:00)
View GitHub Profile
@chriselgee
chriselgee / AlternateDataStreams.md
Last active September 7, 2024 10:42
Finding and reading alternate data streams (ADS) with PowerShell on an NTFS partition

To find all streams within file.txt: Get-Item .\file.txt -Stream *

PSPath        : Microsoft.PowerShell.Core\FileSystem::C:\file.txt::$DATA
PSParentPath  : Microsoft.PowerShell.Core\FileSystem::C:\
PSChildName   : file.txt::$DATA
PSDrive       : C
PSProvider    : Microsoft.PowerShell.Core\FileSystem
PSIsContainer : False
FileName : C:\file.txt