Alternative NTFS Streams in Windows 10

Have you ever heard about alternative NTFS streams in Windows? It is a very interesting feature of the file system, NTFS, used in modern Windows versions. It allows storing extra information (e.g. two text files, or a text and an image simultaneously) in a single file. Here's how to list, read, create, and delete alternative NTFS streams in Windows 10.

So, NTFS, the default file system of modern Windows versions, supports storing multiple streams of data under one file unit. The default (unnamed) stream of a file represents the contents of the file visible in the associated app when you double-click it in File Explorer. When a program opens a file stored on NTFS, it always opens the unnamed stream unless its developer has explicitly coded a different behavior. Besides it, files can have named streams.

Named streams were inherited from the HFS file system of Macintosh, and exist in NTFS starting with its very first versions. For instance, Windows 2000, my favorite and the best version of Windows, used alternative NTFS streams to store file metadata in such streams.

File operations like copy and delete operate with the default stream. Once the system gets a request to delete the default stream of a file, it removes all the associated alternative streams.

So, filename.ext specifies the unnamed stream of the file. The alternate stream syntax is as follows:

filename.ext:stream

The filename.ext:stream specifies the alternate stream simply named "stream". Directories can have alternate streams too. They can be accessed the same way as regular file streams.

You are probably wondering where you can find an alternative stream for a file in your Windows 10 installation? I will give you an example. When you download a file, Windows 10/Edge and other modern browsers create an alternative stream for that file named Zone.Identifier that stores a mark that the file was obtained from the Internet, so it must be unblocked before you start using it.

List Alternative NTFS Streams for File

By default, File Explorer and most third-party file managers do not show alternative streams for files. To list them, you can use either the good old Command Prompt, or its modern counterpart, PowerShell.

To List Alternative NTFS Streams for File in Windows 10, do the following.

1. Open a new command prompt in a folder that contains the files you want to inspect.
2. Type the command dir /R "filename". Substitute the "filename" portion with the actual name of your file.
3. In the output, you will see alternative streams attached to the file (if any) delimited by a colon. The default stream is shown as $DATA.

Alternatively, you can use PowerShell to find alternative NTFS streams for a file.

List Alternative NTFS Streams for a File with PowerShell

1. Open PowerShell in your Downloads folder.
2. Execute the command Get-Item "filename" -Stream *.
3. Substitute the "filename" portion with the actual name of your file.

Now, let's see how to read and write alternative stream data.

To Read Alternative NTFS Stream Contents in Windows 10,

1. Open a new command prompt or PowerShell in a folder that contains the files you want to inspect.
2. In the command prompt, type the command more < "filename:stream name". Substitute the "filename:stream name" portion with the actual name of your file and its stream. E.g. more < "SDelete.zip:Zone.Identifier".
3. In PowerShell, execute the following command: Get-Content "filename" -Stream "stream name". For example, Get-Content "SDelete.zip" -Stream Zone.Identifier.

Note: The built-in Notepad app supports alternative NTFS streams out of the box. Run it as follows: notepad "filename:stream name".

For example, notepad "SDelete.zip:Zone.Identifier".

The popular third-party editor Notepad++ is also able to handle alternative NTFS streams.

Now, let's see how to create an alternative NTFS stream.

To Create Alternative NTFS Stream in Windows 10,

1. Open a new command prompt or PowerShell in a folder of your choice.
2. In the command prompt, execute the command echo Hello World! > hello.txt to create a simple text file.
3. In the command prompt,  execute the command echo Testing NTFS streams > hello.txt:test to create an alternative stream named "test" for your file.
4. Double-click on the hello.txt file to open it in Notepad (or in another app that is set as your default text editor).
5. In the command prompt, type and execute notepad hello.txt:test to see the contents of the alternative NTFS stream.
6. 
7. In PowerShell, you can use the following cmdlet to change the contents of an alternative NTFS stream: Set-Content -Path hello.txt -Stream test. Supply the stream contents when prompted.
8. Hit the Enter key without entering any value to finish editing.

Finally, here's how to delete an alternative NTFS stream for a file in Windows 10.

To Delete Alternative NTFS Stream in Windows 10,

1. Open PowerShell.
2. Run the following command: Remove-Item -Path "filename" -Stream "stream name".
3. Substitute the "filename" portion with the actual name of your file. Replace "stream name" with the actual stream name.

That's it.