Welcome!

By registering with us, you'll be able to discuss, share and private message with other members of our community.

SignUp Now!

Finding Files with Alternate Data Streams

Aug
1,916
68
This script shows how to use PowerShell to display only files with Alternate Data Streams;
Code:
get-ChildItem -recurse | % { get-item $_.FullName -stream * } | where stream -ne ':$Data' | select filename,stream,@{'name'='identifier';"e"={"$($_.filename):$($_.stream)"}}

Output example;
Code:
e:\utils>pshell adsdir.ps1

FileName                Stream          identifier
--------                ------          ----------
E:\Utils\ll.btm         123.txt         E:\Utils\ll.btm:123.txt
E:\Utils\ll.btm         lll.txt         E:\Utils\ll.btm:lll.txt
E:\Utils\sysutils64.dat Zone.Identifier E:\Utils\sysutils64.dat:Zone.Identifier
E:\Utils\TcpLogView.chm Zone.Identifier E:\Utils\TcpLogView.chm:Zone.Identifier

Joe
 
Last edited:
Nice!

Just a small optimization suggestion... no need to pipe to a ForEach-Object (%), as powershell will iterate through all objects sent thru the pipeline anyway in this case:

Code:
Get-ChildItem -Recurse | Get-Item -Stream * | Where-Object .....
 
Back
Top