Alternate Data Streams and Windows XP Test
Needless to say, I was inspired by an article on Windows Security
that did a test using Windows 2000 to try my own test with Windows XP using NTFS. Below are my findings and screen by screen snapshots (Thumbnails are shown, click them to see a larger picture that opens in a new window):
ADS test using Windows XP
1. I begin by making a test directory and copying the c:\windows\system32\calc.exe to it. Notice the original date and timestamp (last modified time and date stamp) of the file is 8/23/2001 8:00AM and the size is 112KB.
Here is a listing in DOS that shows the directory with the copied calc.exe file.
2. I append an ADS (Alternate Data Stream) to the Windows Calculator program I copied to the test directory with another Windows program (Notepad - c:\windows\notepad.exe).
Notice the size of the calc program did not change, bit the timestamp (last modified time and date stamp) DID change.
3. Next, I executed the new ADS notepad.exe using the standard command start.
On the desktop, the NOTEPAD program popped up, even though I had executed the CALC program in the command line.
4. By using CTRL + ALT + DELETE to get the Task Manager, I noticed that my test varied a bit. In the task manager, I could clearly see that calc.exe was running (which I had executed at the command prompt) but, unlike the simple demonstration using Windows 2000, Windows XP displayed the calc.exe name and ADS command.
This is where I must stop and note that depending on the version of windows used, things can be displayed slightly different. Would the average user look at the Task Manager and know that something was different about the calc.exe program that was running? Probably not. Would the average user think anything of the notepad program popping up when the Windows Calculator was used? Some would, others would pass it off as a coincidence or accidentally hitting the wrong key.
