Find and delete NTFS Alternate Data Streams (ADS )

• Download source files - 34.3 Kb

Introduction

Do you know what are NTFS Alternate Data Streams? If not, look at Accessing alternative data-streams of files on an NTFS volume, a Richard Deeming article. There you can download the sources and binaries of the NTFS.dll used in my project.

This project is a Windows GUI extension that allows you to Find and Remove all the interested data streams stored on your local drive or a network folder.

The data is returned in a DataGrid and you can sort it by stream name, size, location and file name.

Using the Form

The core of the form uses a recursive search, and each file found is stored into an ArrayList, and so is all the streams information of the file.

using System;
using System.Drawing;
using System.Collections;
using System.ComponentModel;
using System.Windows.Forms;
using System.Data;
using System.IO;
using NTFS;
using System.Threading;

...

private void DirSearch(string sDir, bool subFolders)
  {
   try
   {
    foreach (string f in Directory.GetFiles(sDir))
    { 
     FileInfo FSInfo = new FileInfo(f);
     NTFS.FileStreams FS = new NTFS.FileStreams(f);
      
     foreach(NTFS.StreamInfo s in FS)
     {
      FileInfoStruct fis;
      fis.File_Name = FS.FileName;
      fis.Stream_Name = s.Name;
      fis.Stream_Size = s.Size;
      fis.Location = FSInfo.DirectoryName;
      fis.Creation_Date = FSInfo.CreationTime;
      ArrayFileInfo.Add(fis);
     } 
    }
    // update the results label
    String caption = "Results:  (" + 
                     this.fileInfoData1.FileInfo.Rows.Count.ToString() + 
                     ")";
    this.dataGridResult.CaptionText = caption;
    if (subFolders)
    {
     foreach (string d in Directory.GetDirectories(sDir))
     {
      DirSearch(d, subFolders);
     }
    }
   }
   catch
   {
   }
  }