drop ads inventory csv or ntfs file listing · detect files with alternate data streams · identify hidden data in NTFS streams · surface stream names indicating zone identifier manipulation or hidden payloads · runs locally
ADS inventory
drop ADS / NTFS stream csv (multi-file)
or click
Streams.exe · PowerShell Get-Item -Stream · Velociraptor NTFS listings with stream columns
drop ADS inventory csv (Streams.exe, Get-Item -Stream, Velociraptor)