Quantcast
Channel: Forensic Focus Forums - Recent Topics
Viewing all articles
Browse latest Browse all 20112

General Discussion: Alternate Data Streams

$
0
0
shakes wrote: Is there an offset in any of the attribute headers, attributes, or MFT header that tells you if a file as an ADS? You want the $DATA attribute(s) in the $MFT record. The nameless $DATA is the 'standard file contents' (there can be only one of these), while any named $DATA streams are what usually are refered to as ADSs . You probably also want Brian Carrier's book 'File System Forensic Analysis'.

Viewing all articles
Browse latest Browse all 20112

Trending Articles