I know that to display alternate data streams of all the files (if any) in command prompt, this is the command dir /R
. But, how do I do it if I only want to display files that have alternate data streams?
-
Put it in a for loop batch.– EndoroMay 2, 2013 at 16:15
-
what do you mean by put in for loop? because dir /R displays all files, regardless of them having ADS or not. I'm asking if there is a way to only show the files that have ADS, if possible, output them to a text file.– csharpnewbieMay 9, 2013 at 8:53
-
Can you use "streams" from Microsoft Sysexternals?– EndoroMay 9, 2013 at 9:37
-
erm i need the command in command prompt, can't use any other programs :/– csharpnewbieMay 9, 2013 at 10:35
-
1"Streams" is a command line tool, for use on the command prompt.– EndoroMay 9, 2013 at 10:57
Add a comment
|
1 Answer
dir /s /r | findstr /e ":$DATA"
or
dir /r | findstr /e ":$DATA"
the first will search in all sub-directories.The second only in current folder. These will show also the ADS assigned to the directory.For only files:
dir /a-d /s /r | findstr /e ":$DATA"
-
What if the alternate stream is named something other than ":$DATA"? What about ":HIDDEN" or ":MALWARE", etc.? Apr 1 at 15:34
-
@JimJRHarris - try this:
(echo #>:ads) && (dir /r /s)
- all alternate data streams end with$DATA
when dir command is used.– npocmakaApr 1 at 18:56