TLDRBins TLDRBins / Alternate Data Stream

Usage Tips:

  • Click on a keyword to enable inline editing.
  • Click inside a code block to copy (excludes comments).
  • Use the button to view examples.
  • Click outside to collapse all examples.

Show ADS

# cmd
cmd /C dir /R <PATH>

Sample Output:
C:\Users\Administrator\Desktop> cmd /C dir /R C:\users\administrator\desktop
 Volume in drive C has no label.
 Volume Serial Number is 71A1-6FA1

 Directory of C:\users\administrator\desktop

11/08/2017  10:05 AM    <DIR>          .
11/08/2017  10:05 AM    <DIR>          ..
12/24/2017  03:51 AM                36 hm.txt
                                    34 hm.txt:root.txt:$DATA
11/08/2017  10:05 AM               797 Windows 10 Update Assistant.lnk
               2 File(s)            833 bytes
               2 Dir(s)   2,652,184,576 bytes free

# Read
more < <FILE>:<STREAM>

Sample Output:
C:\Users\Administrator\Desktop> more < hm.txt:root.txt
7ddf32e17a6ac5ce04a8ecbf782ca509

# powershell
Get-Item -Path <PATH>\* -force -stream *

Sample Output:
PS C:\users\administrator\Desktop> Get-Item -Path C:\users\administrator\Desktop\* -force -stream *

   FileName: C:\users\administrator\Desktop\desktop.ini

Stream                   Length
------                   ------
:$DATA                      282

   FileName: C:\users\administrator\Desktop\hm.txt

Stream                   Length
------                   ------
:$DATA                       36
root.txt                     34

   FileName: C:\users\administrator\Desktop\Windows 10 Update Assistant.lnk

Stream                   Length
------                   ------
:$DATA                      797

# Read
Get-Item <FILE> | Get-Content -Stream <STREAM>

Sample Output:
PS C:\users\administrator\Desktop> Get-Item hm.txt | Get-Content -Stream root.txt
7ddf32e17a6ac5ce04a8ecbf782ca509