Hiding Files in NTFS

[iago]

This is a really cool feature of NTFS that very few people know about.  Basically, you can hide any number of files (or "streams"), inside another file.  Open a command prompt, and go to your desktop (or where ever), do do the following:

Code Select Expand

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Ron> echo "This is an empty file, trust me!" > file.txt

C:\Documents and Settings\Ron> type C:\windows\system32\sol.exe > file.txt:hidden1.exe

C:\Documents and Settings\Ron> C:\windows\system32\winmine.exe > file.txt:hidden2.txt

C:\Documents and Settings\Ron> type C:\windows\system32\winmine.exe > file.txt:hidden2.exe

C:\Documents and Settings\Ron> start .\file.txt:hidden1.exe

C:\Documents and Settings\Ron> start .\file.txt:hidden2.exe

The "echo" simply creates an empty file.
The two "type" lines embed two different .exe's inside file.txt.  No matter what you do to file.txt, you'll never be able to see them.
The next two lines run the two different hidden programs. You can run these like this at any time.

Note that this _won't_ work across a network or if you put it in a zip or anything else, since this is a feature of ntfs.

[c0Ld]

Yay, new way to hide my porn!

[Quik]

haha that pwns, thx iago..

[Newby]

That is hot. :)

[Warrior]

What aboot FAT32  ???

[Sidoh]

What aboot FAT32  ???

Thats a silly question. :P

FAT32 is an old, outdated file system. IIRC, it doesn't even have security settings for different users! I doubt FAT32 could do this. :P

[iago]

No, this is an NTFS-specific feature.

It's actually used a little in Windows.  For example, thumbnails of images (I'm told) are stored in a seperate stream.  Also, right click on a text file, and go to the "Summary" tab -- that information is stored in seperate streams as well.

I'll post a program to find extra streams so you can find what else has it when I get to work.  I forget what the program is called, though.

[rabbit]

So once you embed the file within the other file (say, a text file with a bunch of usernames & passwords into a blank text file) can you delete the original and just save/edit through start and then notepad, or what?

[iago]

I've never tried deleting the original, but I would imagine it woulnd't work.

Incidentally, you can also hide files in folders.

[Troop]

Thanks iago, cool trick....

[deadly7]

* deadly7 :confuse:

I've never used NTFS before (go ahead laugh.. no need)
How would you open the hidden files?

C:\Documents and Settings\Ron> start .\file.txt:hidden1.exe

C:\Documents and Settings\Ron> start .\file.txt:hidden2.exe

Those two lines, but is that done in DOS/Command Prompt?

Also, you can change the file name to like... JPG or GIF right? (99% yes, but what the hell might as well ask)

[Quik]

You're bumping old topics. And..

It's actually used a little in Windows.  For example, thumbnails of images (I'm told) are stored in a seperate stream.  Also, right click on a text file, and go to the "Summary" tab -- that information is stored in seperate streams as well.

I thought this was thumbs.db or whatever.

[deadly7]

I bumped this topic cause I didn't understand the last part, how to get the file OUT.

[iago]

I can't remember, go find an article on AFS :)

Incidentally, I read something that sounded to me like SP2 is using these to store information on downloaded files