Finding Files with Alternate Data Streams

This script shows how to use PowerShell to display only files with Alternate Data Streams;
Code:
get-ChildItem -recurse | % { get-item $_.FullName -stream * } | where stream -ne ':$Data' | select filename,stream,@{'name'='identifier';"e"={"$($_.filename):$($_.stream)"}}

Output example;
Code:
e:\utils>pshell adsdir.ps1

FileName                Stream          identifier
--------                ------          ----------
E:\Utils\ll.btm         123.txt         E:\Utils\ll.btm:123.txt
E:\Utils\ll.btm         lll.txt         E:\Utils\ll.btm:lll.txt
E:\Utils\sysutils64.dat Zone.Identifier E:\Utils\sysutils64.dat:Zone.Identifier
E:\Utils\TcpLogView.chm Zone.Identifier E:\Utils\TcpLogView.chm:Zone.Identifier

Joe
 
Last edited:
May 26, 2008
550
6
Nice!

Just a small optimization suggestion... no need to pipe to a ForEach-Object (%), as powershell will iterate through all objects sent thru the pipeline anyway in this case:

Code:
Get-ChildItem -Recurse | Get-Item -Stream * | Where-Object .....