0
I know alternate data streams (ADSs) can be removed from files and directories but have heard that they can't be removed from a volume. Let’s say the following command is run:
C:\type nc.exe > C:\:nc.exe
(note the : after the C:\ in the output file name.)
This would put the ADS directly on the C: drive. Is it possible to remove this ADS from the drive without having to totally delete the drive and rebuild it? The examples of alternate data streams I’ve been able to find for removing alternate data streams have been removing them from files only. I haven’t been able to find any information as to whether or not it’s possible to remove them from drives or partitions.
Euretta Wilson
Posted 2017-03-09T00:42:23.870
Reputation: 111
1Can you give an example of such an alternate data stream name? – Ben Voigt – 2017-03-09T00:58:02.883
...& how you know there is one attached to a volume, rather than a file? – Tetsujin – 2017-03-09T08:22:49.540
Let’s say the following command is run: C:\type nc.exe > C::nc.exe. This would put the ADS directly on the C: drive. Is it possible to remove this ADS from the drive without having to totally delete the drive and rebuild it? The examples of alternate data streams I’ve been able to find for removing alternate data streams have been removing them from files only. I haven’t been able to find any information as to whether or not it’s possible to remove them from folders or partitions. – Euretta Wilson – 2017-03-10T15:23:32.053
1(1) Please do not use comments to clarify your question; rather, [edit] your question. I’ve done this one for you. (2) What filesystem type are you talking about? (Yeah, it may be obvious, but state it anyway.) (3) You contradicted yourself: you said “I know [ADSs] can be removed from files and directories,” but then you also said, “The [instructions] I’ve been able to find … have been removing them from files only. I haven’t been able to find any information [about removing] them from folders or partitions.” Or do you not consider directories and folders to be the same thing? – Scott – 2017-04-03T00:38:56.503