Hiding Files Using NTFS File Streaming

NTFS file streaming allows a hidden file to be created within a legitimate file. The hidden file does not

appear in a directory listing but the legitimate file does. A user would usually not suspect the legitimate

file, but the hidden file can be used to store or transmit information.


Note: This exercise will only work on systems using the NTFS file system.

To create and test an NTFS file stream:

1. At the command line, enter notepad test.txt.

2. Put some data in the file, save the file, and close Notepad. Step 1 will open Notepad.

3. At the command line, enter dir test.txt and note the file size.

4. At the command line, enter notepad test.txt:hidden.txt. Type some text into Notepad, save the file, and

    close it.

5. Check the file size again (it should be the same as in step 3).

6. Open test.txt. You see only the original data.

7. Enter type test.txt:hidden.txt at the command line. A syntax error message is displayed.