'Super Hidden' Files in Windows (Even Experts Don't Know About)

I bet almost none of you know about this 🤔

▼ Time Stamps: ▼
0:00 - Intro
1:13 - Hiding Text
2:58 - Hiding An Entire File
5:01 - Some Additional Points
5:23 - Deleting Alternate Data Streams
6:21 - How to Find Alternate Data Streams
7:59 - AlternateStreamView Tool
9:20 - Real Usage Examples
11:40 - What's the Point?

▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬
▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬

[IsfarTausif]

Thanks. Now I know where to hide my "Homework" folder

[c-LAW]

I learned about Streams in 1998 in a security training class. They can be used to hide any file, even malicious files. anti virus scanners don't check for files in streams.

[NoNonsense]

I made my living in IT for over 25 years. Started out with standard desktop break-->fix work and worked my way up to Enterprise WAN management. I've also done some scripting and programming. I would easily fit into the "expert" category (though I never liked calling myself that) and was often referred to as such - if someone was told to call the expert, they'd be calling me. In all those years, I never even heard of alternate data streams in Windows.

Like they say, "you learn something new every day." My hat comes off to you for even finding this feature and then explaining it, well, "expertly." Well done!

[hackdesigner]

The term "superhidden" is itself in registry used for "protected system files". The NTFS data streams are not separate files, rather attributes.

[aashd]

You can also use WSL to create a folder NUL or use parted magic to create folder with forbidden characters or use UNC paths to create folders ending with space alongside a folder not ending with space.

[the_dark_jumper]

As a noobie data-hoarder, the Zone Identifier seems extremely useful.
It's a shame that it's hidden away like that, I really like the idea of files keeping track of their origin.

[DavidWonn]

Usually when I hear of "super hidden" files, it has to do with a completely separate concept from Alternative Data Streams (available as far back as Windows NT) which are the desktop ini files. These alter how Explorer shows (or hides) the current folder (and sometimes even its parent folder!) in every Windows version since Win 95. The most notable example is the recycle bin. You can see its true structure inside cmd or winfile (if available) but not within Windows Explorer.

[FunWithBits]

I work in IT and did not even know this. I also always wondered how the OS would know a file came from the internet. I thought it might be some database or registry somewhere but it was odd because when I copy the file to another computer this would stay with the file...now I know. Thank you.

[UahUahUah]

you teach me something pretty much every time i upload. hopefully one day i can keep this knowledge heading downstream and help other people. thank you!

[davidlean]

When we first launched NTFS we had a whole section in our 5-day training course, dedicated to streams & how to access them. The vision of the dev team was quite vast. 1. They'd let you extend the NTFS properties, so you could add your own custom tags needed to support an advanced Document management system. each file became the equivalent of a row in a doc database.
2. You could do version control. Keeping the delta between the version as streams. 3. You could do translations. The doc could contain streams for French, Spanish, English etc. & your application opens what it likes.
4. Similar to (1) Audio & Video could be tagged with production attributes commonly used in radio or TV production.

Unsurprisingly it never took off. Most Architects & developers don't get close enough to the API's to really understand how extensible & powerful the Microsoft products really are. So they don't think to use them, or they design some complex system to do the same thing the product does better out-of-the-box. I'm not saying that is their fault. There is only so many hours you can devote to really learning a product.

[presidentlion]

I knew about this when I checked out the alternate streams option in 7zip, in which I found the zone.identifier file, and now you have confirmed those things do exist

[bwcbiz]

Alternate data streams (in theory) could also be used for version control and document history. I'm surprised this isn't in wider use.

[jordansean]

My favorite trick that blew my mind was when I learned you could unzip Microsoft office files and see all the hidden plaintext xml files ☺️

[NoNameBAM]

"Anaheim" in the SmartScreen files? Interesting. The codename for "new Edge" (the Chromium based one) is "Anaheim".

[lyfandeth]

Streams came with the NTFS file system.
Nice to know the access is so simple!

[HenryLoenwind]

OS/2 has a nice use for this. It uses REXX as a scripting language (like Windows uses PowerShell), but that is a compiled language. It will be compiled automatically when you start a REXX file, but that could takes several seconds back in the day. To speed this up, the compiled version i saved in a data stream. So starting a REXX program is only slow the very first time you run it.

[HTMLbrowser]

When the input file contains a [Ctrl]+"Z" character the TYPE command stops there with displaying text. Typically a remnant of the MS-DOS days. I suggest using the COPY /B variant to add an alternative data stream.

[vtreanor]

Nice one. No irrelevant chatter just real information.

[cuteswan]

Heh, extracting data from Mac files on an NT 4.0 server was exactly how I learned about streams. I hacked together a few utilities & menu items so I can quickly see where downloaded files originally came from. Lots of cool things, and lots of programs like Firefox, Notepad++ etc. can get at the streams if you know they exist. I've had way too much fun messing around with them.

[anarchyserver]

6:01 as someone who works with USB drives a lot i have seen this several times but never thought about what exactly it meant.