Get a list of all files with alternate streams?

[vefatica]

Any ideas?

 

[Joe Caverly]

http://www.nirsoft.net/utils/alternate_stream_dump.html

AltStreamDump is a console application (Command Prompt) that dumps the list of NTFS alternate streams found in the current directory. By using a few command-line options, you can also instruct AltStreamDump to displays the alternate streams list of other folders and to scan subfolders in the desired folder depth.

Joe

 

[Christian Albaret]

DIR/: list the files and their possible streams.
You can process DIR's output through a small script and display the information you want.

 

[Joe Caverly]

https://technet.microsoft.com/en-us/sysinternals/bb897440.aspx

Joe

 

[vefatica]

DIR/: list the files and their possible streams.
You can process DIR's output through a small script and display the information you want.

Yes, I know. But it produces a ton of unwanted information. This works.

dir /f /: /s c:\users\vefatica\* | grep :.*:
C:\users\vefatica\Desktop\Stuff\MercuryConsole.zip:Zone.Identifier:$DATA
C:\users\vefatica\Desktop\Stuff\mseinstall.exe:Zone.Identifier:$DATA
C:\users\vefatica\Desktop\Stuff\plantronics.pdf:Zone.Identifier:$DATA
<snip>

I was wondering about doing it without externals. What did you have in mind for a script?

 

[vefatica]

I guess I'm bemoaning the fact that wildcard matching is not applied to streams.

v:\> dir /f /: /s | grep :.*:
V:\mtest\my2click64(1)\My2click.exe:Zone.Identifier:$DATA
V:\mtest\my2click64(1)\my2clickdll.dll:Zone.Identifier:$DATA

v:\> dir /f /: /s *Zone*

v:\>

 

[Christian Albaret]

Yes, I know. But it produces a ton of unwanted information. This works.

dir /f /: /s c:\users\vefatica\* | grep :.*:
C:\users\vefatica\Desktop\Stuff\MercuryConsole.zip:Zone.Identifier:$DATA
C:\users\vefatica\Desktop\Stuff\mseinstall.exe:Zone.Identifier:$DATA
C:\users\vefatica\Desktop\Stuff\plantronics.pdf:Zone.Identifier:$DATA
<snip>

I was wondering about doing it without externals. What did you have in mind for a script?

I was thinking about a script like this

dir /: | FileWithStream.btm

with FileWithStream.btm being

@echo off
:: pipe DIR output, display files with streams
setlocal
setdos /X-6
do xLine in @con:
    iff "%xLine" eq "" then
        echo.
    elseiff %@isdigit[%@left[1,%xLine]] == 1 then
        :: file: store the line
        set vLastFile=%xLine
    else
        :: stream (display file) or other line
        iff %@index[%xLine,octets dans] ge 0 then
            set vLastFile=
        elseiff "%vLastFile" ne "" then
            echo %vLastFile
            set vLastFile=
        endiff
        echo %xLine
    endiff
enddo
endlocal

- it is designed to filter the output of DIR/: ; for DIR/F/: you have to write it differently
- it displays the files and the stream; if you want only the files, you have to write it differently
- it depends on the language (here through the french "octets dans" string, that identifies the first line of DIR's summary)

 

[vefatica]

What I want is a name I can give to DEL. This will be OK after I chop off the ":$DATA".

C:\users\vefatica\Desktop\Stuff\MercuryConsole.zip:Zone.Identifier:$DATA

 

[samintz]

This worked for me:

dir /f /s /: c:\ | ffind /v /e"C:\\.+:"

 

[vefatica]

This worked for me:

dir /f /s /: c:\ | ffind /v /e"C:\\.+:"

Duh! I should have thought of FFIND. ... better yet, TPIPE could probably do the grep-ing and remove the ":$DATA".

 

[vefatica]

dir /f /s /: c:\users\vefatica\* | tpipe /grep=3,0,0,0,0,0,0,0,":.*:" /replace=4,0,0,0,0,0,0,0,0,":.DATA",""

 

[vefatica]

A little more generic:

dir /f /s /: c:\users\vefatica\* | tpipe /grep=3,0,0,0,0,0,0,0,":.*:" /replace=4,0,0,0,0,0,0,0,0,":\$.*$",""