drop mft csv or file listing with ads entries · enumerate all alternate data streams · extract content where possible · detect zone identifier abuse · flag hidden executables · surface data concealment · runs locally
ads artifacts
drop mft / dir /r / ads csv
or click
MFTECmd with -ads · dir /r output · custom ADS inventory
drop mft csv (mftecmd -ads) · dir /r listing · ads inventory csv