17

I know that to display alternate data streams of all the files (if any) in command prompt, this is the command dir /R. But, how do I do it if I only want to display files that have alternate data streams?

5
  • Put it in a for loop batch.
    – Endoro
    May 2, 2013 at 16:15
  • what do you mean by put in for loop? because dir /R displays all files, regardless of them having ADS or not. I'm asking if there is a way to only show the files that have ADS, if possible, output them to a text file. May 9, 2013 at 8:53
  • Can you use "streams" from Microsoft Sysexternals?
    – Endoro
    May 9, 2013 at 9:37
  • erm i need the command in command prompt, can't use any other programs :/ May 9, 2013 at 10:35
  • 1
    "Streams" is a command line tool, for use on the command prompt.
    – Endoro
    May 9, 2013 at 10:57

1 Answer 1

22
dir   /s /r | findstr /e ":$DATA"

or

dir   /r | findstr /e ":$DATA"

the first will search in all sub-directories.The second only in current folder. These will show also the ADS assigned to the directory.For only files:

dir /a-d  /s /r | findstr /e ":$DATA"
2
  • What if the alternate stream is named something other than ":$DATA"? What about ":HIDDEN" or ":MALWARE", etc.? Apr 1 at 15:34
  • @JimJRHarris - try this: (echo #>:ads) && (dir /r /s) - all alternate data streams end with $DATA when dir command is used.
    – npocmaka
    Apr 1 at 18:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.