Forensic Techniques to Detect Hidden Data in Alternate Data Streams in NTFS

Abstract

Alternate Data Streams (ADS) have been a feature of the New Technology File System (NTFS) since its introduction in 1993. Alternate Data Streams (ADS) were introduced to address compatibility within the existing Operating Systems. Lately Hackers/Cyber Criminals have used Alternate Data Streams (ADS) as a means for launching Cyber- Attacks. Alternate Data Streams (ADS) allow data hiding, same being difficult to detect without adequate knowledge. In this paper we shall bring out the various Forensic techniques in which hidden data in Alternate Data Streams (ADS) can be detected. Finally, we compared the Forensic techniques to detect data hidden in Alternate Data Streams (ADS) in both Windows 10 and 11 Operating System.