Finding Files with Alternate Data Streams

[Joe Caverly]

This script shows how to use PowerShell to display only files with Alternate Data Streams;

get-ChildItem -recurse | % { get-item $_.FullName -stream * } | where stream -ne ':$Data' | select filename,stream,@{'name'='identifier';"e"={"$($_.filename):$($_.stream)"}}

Output example;

e:\utils>pshell adsdir.ps1

FileName                Stream          identifier
--------                ------          ----------
E:\Utils\ll.btm         123.txt         E:\Utils\ll.btm:123.txt
E:\Utils\ll.btm         lll.txt         E:\Utils\ll.btm:lll.txt
E:\Utils\sysutils64.dat Zone.Identifier E:\Utils\sysutils64.dat:Zone.Identifier
E:\Utils\TcpLogView.chm Zone.Identifier E:\Utils\TcpLogView.chm:Zone.Identifier

Joe

 

[drwtsn32]

Nice!

Just a small optimization suggestion... no need to pipe to a ForEach-Object (%), as powershell will iterate through all objects sent thru the pipeline anyway in this case:

Get-ChildItem -Recurse | Get-Item -Stream * | Where-Object .....