Finding Alternate Data Stream

Finding Alternate Data Stream

We can use LADS to find if any Alternate Data Stream is hidden in Our System

Syntax are pretty simple. adding /s is also look for subdirectory

C:\>lads c:\
LADS - Freeware version 4.00
(C) Copyright 1998-2004 Frank Heyne Software (http://www.heysoft.de)
This program lists files with alternate data streams (ADS)
Use LADS on your own risk!
Scanning directory C:\
size ADS in file
---------- ---------------------------------
Error 32 opening C:\pagefile.sys
368146432 C:\sample.txt:pp.avi
18 C:\sample.txt:secret.txt
21 C:\data\:mean.txt
The following summary might be incorrect because there was at least one error!
368132511 bytes in 3 ADS listed


C:\>lads /?

LADS - Freeware version 4.00
(C) Copyright 1998-2004 Frank Heyne Software (http://www.heysoft.de)
This program lists files with alternate data streams (ADS)
Use LADS on your own risk!

Usage: LADS [Directory] [/S] [/D] [/A] [/Xname]
Directory: directory to scan, current if ommitted
/S include Subdirectories
/D Debug LADS ;-)
/V Verbose error reports
/A give a summary of All bytes used in the scanned directories
(All files and directories are considered as uncompressed
and all security decriptions are skipped
for calculating this number!)
/Xname eXclude any ADS "name"
/Pfile read Parameters from "file"

C:\> 
Download LADS from LADS DOWNLOAD

In Windows Vista & Higher OS you can try

DIR /R command for the same