NTFS data stream inspection tool AlternateStreamView

AlternateStreamView is a small tool that allows you to scan your NTFS drive and find all hidden alternate streams in the file system. After scanning, alternative streams are found, you can extract these streams to a specified folder, delete unnecessary streams, or save text list/.html/.csv/.xml files.

Version history:

Version 1.40:
Added "Open Folder in Explorer" option.
Added 64-bit version.

Version 1.36:
You can now specify which folders to scan (eg: %LOCALAPPDATA%, %APPDATA%)
Version 1.35:
Bug fixed: when searching for wildcards, not *. *, AlternateStreamView cannot scan subfolders.
Fixed issue with wrong monitor: other windows opening, multi-monitor systems.

Version 1.32:

Added "Extension" column, allowing you to easily sort the stream list by file extension.
Version 1.31:
Fixed BUG: AlternateStreamView crashed when trying to delete the long file name of the alternate stream.

Version 1.30 adds a 'File Wildcard' option which allows you to scan only files with a specific name/extension.

What is the use of AlternateStreamView?

NTFS alternate data streams (ADS for short) is a feature of the NTFS disk format. Under the NTFS file system, each file can have multiple data streams, which means that in addition to the main file stream, there can be many non-data streams. The main file stream is hosted in the main file stream. It uses resource forking to maintain file-related information. Although we cannot see the data flow file, it actually exists in our system.​

So far, many anti-virus software are still unable to detect and kill NTFS data stream files on the local machine and Trojans created using data streams. We can use some NTFS data stream inspection tools to find malicious files hidden in the system.