Code to View NTFS Alternative Data Streams via streams.exe
Posted: Mon Jan 14, 2013 3:26 pm
Hi to All
If anyone's interested just a small Console code example to parse System Internals streams.exe output to view the NTFS Alternative Data Sreams in your file system. just to be nosey and see whats there
Zebuddi.
http://technet.microsoft.com/en-us/sysinternals
If anyone's interested just a small Console code example to parse System Internals streams.exe output to view the NTFS Alternative Data Sreams in your file system. just to be nosey and see whats there

Zebuddi.

http://technet.microsoft.com/en-us/sysinternals
Code: Select all
;-----------------------------------------------------------------------------------------------
;-----------------------------------------------------------------------------------------------
;Display NTFS Alternative Data Streams via parsing Sysytem Internals streams.exe
;
; create an output via redirection from streams.exe
; from cmd stream.exe -s > c:\users\YOURNAME\desktop\streams.txt
; Author Zebuddi. 12/1/2013
;-----------------------------------------------------------------------------------------------
;-----------------------------------------------------------------------------------------------
Structure ads
f$
List ads$()
EndStructure
Define.i
NewList f.ads()
ProcedureDLL.s __GetLastErrorAsText(LastError.l) ; Used to get Last Win32 API Error
If LastError
*ErrorBuffer = AllocateMemory(1024)
FormatMessage_(#FORMAT_MESSAGE_FROM_SYSTEM, 0, LastError, 0, *ErrorBuffer, 1024, 0)
message.s=PeekS(*ErrorBuffer)
FreeMemory(*ErrorBuffer)
EndIf
ProcedureReturn message
EndProcedure
ProcedureDLL __GetLastError() ; Return the last Win32 API error as a string
; Error 1309 or 0 = No error
LastError=GetLastError_()
If LastError=1309 : LastError=0 : EndIf
ProcedureReturn LastError
EndProcedure
file$="C:\Users\"+UserName()+"\Desktop\streams.txt" ; place file and path in file$
; username() requires PB5.10x
If OpenConsole("Alternative Data Sreams: Viewer")
EnableGraphicalConsole(1)
If ReadFile(0,file$)
For i=1 To 4
ReadString(0) ; ignore file info
Next
; filter out any streams and it`s main filename into linkedlist that we want
While Eof(0)=0
a$=LCase(Trim(ReadString(0)))
If Not FindString(a$,"Error opening") Or Not FindString(a$,"cannot") Or Not a$="" Or Not a$="." Or Not a$=".." Or Not a$="..."
If FindString(a$,"c:\")
counter=0
AddElement(f())
f()\f$= a$
ElseIf FindString(a$,"$data")
AddElement(f()\ads$())
counter+1
f()\ads$()=a$
EndIf
EndIf
Wend
CloseFile(0)
Else
ConsoleColor(12,0)
ConsoleLocate(2,2)
Print("Cannot open file "+file$)
ConsoleLocate(2,4)
PrintN("ERROR: "+__GetLastErrorAsText(__GetLastError()))
ConsoleLocate(2,6)
Print("Press any key to Quit!")
Input()
FreeList(f())
End
EndIf
;process linkedlist read streams and display
ResetList(f())
FirstElement(f())
ForEach f()
ForEach f()\ads$()
fecounter+1
ads$=Mid(f()\ads$(),2)
x=FindString(ads$,":")
ads$=Mid(ads$,1,x-1)
f$=f()\f$+ads$
If ReadFile(0,f$)
d+1: page+1
PrintN(Str(d)+". "+ GetFilePart(f$))
If page=15
ConsoleColor(12,0)
PrintN("")
PrintN("Paging: press any key to continue!")
Input()
page=0
EndIf
ConsoleColor(10,0)
PrintN( ReadString(0))
ConsoleColor(15,0)
PrintN(" ")
CloseFile(0)
EndIf
Next
Next
If fecounter=0
PrintN("")
PrintN("No Alternative Data Streams Found")
PrintN("")
PrintN("Press Any key To Quit!")
EndIf
Input()
Else
PrintN("cannot open file"+file$)
PrintN("ERROR: "+__GetLastErrorAsText(__GetLastError()))
PrintN("Press Any key To Quit!")
Input()
EndIf
FreeList(f())
CloseConsole()
End