Home HowTo FileSystem Reading And Writing Alternate Data Streams
 

Reading And Writing Alternate Data Streams

Starting with PowerShell 3.0, you can read and write NTFS alternate data streams.

Take a look at this code:

  

$file = "$env:temp\file.txt"
Set-Content -Path $file -Value 'Test'
Get-Content -Path $file

  Writing and Reading to file

This creates a text file, adds some text content, and reads it back into PowerShell.

Add Hidden Data

Now, you can add additional information to alternate (hidden) streams if the file is stored on an NTFS volume:

  

Add-Content -Path $file -Value 'Secret Information' -Stream 'secretStream'
Get-Content -Path $file

Get-Content -Path $file -Stream 'secretStream'

  Adding secret information using NTFS Alternate Data Streams

This is what the result will look like:

PS> Get-Content -Path $file
Test

PS> Get-Content -Path $file -Stream 'secretStream'
Secret Information

As you can see, Get-Content can now retrieve two pieces of information: one is stored inside the text file, the other one comes from the NTFS Alternate Data Stream.

Note that the secret stream information is not returned unless you specify the stream. When you look into the file with an editor like notepad, you cannot see the secret information. You can create as many streams as you want.

Just be aware: streams are a feature of NTFS. So if you copy the file to a non-NTFS-volume (like an USB stick or some network location), stream information gets lost.

Stream support is new in PowerShell 3.0. Many cmdlets have been appended with a -Stream parameter.