lsads /

Filename Size Date modified Message
204 B
12.2 KB
5 B
1.4 KB
4.2 KB
481 B
69 B
11 B
53.4 KB
236 B
82 B
1.3 KB
1.8 KB
1.9 KB
14.7 KB
12.8 KB
9.0 KB
1.6 KB
705 B
28.7 KB
878 B
4.4 KB
879 B
4.3 KB
289 B
261 B
246 B
682 B

CAlternateDataStreams and lsads

Author: Oliver Schneider

About

CAlternateDataStreams is a C++ utility class without dependencies to the STL, MFC, ATL or some such. It allows you to list all the alternate data streams (ADS) on an NTFS file or folder.

lsads is a simple tool to enumerate the ADS from the command line.

Installation

No installation required. Download the binaries (32 and 64bit) from my website. Use an archiver to unpack the archive, I recommend 7zip, and then place the .exe files into a folder listed in your PATH environment variable.

As for the utility class all you need is to place the files AlternateDataStreams.h and VerySimpleBuf.h into your project, #include the former and you should be set to use the CAlternateDataStreams C++ class.

Requirements

The program should run on Windows 2000 and later. Itanium CPUs are not supported, but feel free to build that yourself, if needed.

The CAlternateDataStreams class should work starting on Windows 2000, too. If you happen to have some old NT4 box around, try it there. It's likely it will still work even there (except if your linker does funny things).

Usage

Syntax:

lsads <filename>

License

The tools and the classes are placed into the PUBLIC DOMAIN (CC0).

Tip: Filter by directory path e.g. /media app.js to search for public/media/app.js.
Tip: Use camelCasing e.g. ProjME to search for ProjectModifiedEvent.java.
Tip: Filter by extension type e.g. /repo .js to search for all .js files in the /repo directory.
Tip: Separate your search with spaces e.g. /ssh pom.xml to search for src/ssh/pom.xml.
Tip: Use ↑ and ↓ arrow keys to navigate and return to view the file.
Tip: You can also navigate files with Ctrl+j (next) and Ctrl+k (previous) and view the file with Ctrl+o.
Tip: You can also navigate files with Alt+j (next) and Alt+k (previous) and view the file with Alt+o.