1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Get a list of all files with alternate streams?

Discussion in 'Support' started by vefatica, Jan 26, 2015.

  1. vefatica

    Joined:
    May 20, 2008
    Messages:
    8,075
    Likes Received:
    30
    Any ideas?
     
  2. Joe Caverly

    Joined:
    Aug 28, 2009
    Messages:
    698
    Likes Received:
    8
    http://www.nirsoft.net/utils/alternate_stream_dump.html

    AltStreamDump is a console application (Command Prompt) that dumps the list of NTFS alternate streams found in the current directory. By using a few command-line options, you can also instruct AltStreamDump to displays the alternate streams list of other folders and to scan subfolders in the desired folder depth.

    Joe
     
  3. Christian Albaret

    Joined:
    Jul 1, 2008
    Messages:
    158
    Likes Received:
    1
    DIR/: list the files and their possible streams.
    You can process DIR's output through a small script and display the information you want.
     
  4. vefatica

    Joined:
    May 20, 2008
    Messages:
    8,075
    Likes Received:
    30
    Yes, I know. But it produces a ton of unwanted information. This works.
    Code:
    dir /f /: /s c:\users\vefatica\* | grep :.*:
    C:\users\vefatica\Desktop\Stuff\MercuryConsole.zip:Zone.Identifier:$DATA
    C:\users\vefatica\Desktop\Stuff\mseinstall.exe:Zone.Identifier:$DATA
    C:\users\vefatica\Desktop\Stuff\plantronics.pdf:Zone.Identifier:$DATA
    <snip>
    
    I was wondering about doing it without externals. What did you have in mind for a script?
     
  5. vefatica

    Joined:
    May 20, 2008
    Messages:
    8,075
    Likes Received:
    30
    I guess I'm bemoaning the fact that wildcard matching is not applied to streams.
    Code:
    v:\> dir /f /: /s | grep :.*:
    V:\mtest\my2click64(1)\My2click.exe:Zone.Identifier:$DATA
    V:\mtest\my2click64(1)\my2clickdll.dll:Zone.Identifier:$DATA
    
    v:\> dir /f /: /s *Zone*
    
    v:\>
     
  6. Christian Albaret

    Joined:
    Jul 1, 2008
    Messages:
    158
    Likes Received:
    1
    I was thinking about a script like this
    Code:
    dir /: | FileWithStream.btm
    
    with FileWithStream.btm being
    Code:
    @echo off
    :: pipe DIR output, display files with streams
    setlocal
    setdos /X-6
    do xLine in @con:
        iff "%xLine" eq "" then
            echo.
        elseiff %@isdigit[%@left[1,%xLine]] == 1 then
            :: file: store the line
            set vLastFile=%xLine
        else
            :: stream (display file) or other line
            iff %@index[%xLine,octets dans] ge 0 then
                set vLastFile=
            elseiff "%vLastFile" ne "" then
                echo %vLastFile
                set vLastFile=
            endiff
            echo %xLine
        endiff
    enddo
    endlocal 
    
    - it is designed to filter the output of DIR/: ; for DIR/F/: you have to write it differently
    - it displays the files and the stream; if you want only the files, you have to write it differently
    - it depends on the language (here through the french "octets dans" string, that identifies the first line of DIR's summary)
     
  7. vefatica

    Joined:
    May 20, 2008
    Messages:
    8,075
    Likes Received:
    30
    What I want is a name I can give to DEL. This will be OK after I chop off the ":$DATA".
    Code:
    C:\users\vefatica\Desktop\Stuff\MercuryConsole.zip:Zone.Identifier:$DATA
     
  8. samintz

    samintz Scott Mintz

    Joined:
    May 20, 2008
    Messages:
    1,201
    Likes Received:
    11
    This worked for me:
    Code:
    dir /f /s /: c:\ | ffind /v /e"C:\\.+:"
    
     
  9. vefatica

    Joined:
    May 20, 2008
    Messages:
    8,075
    Likes Received:
    30
    Duh! I should have thought of FFIND. ... better yet, TPIPE could probably do the grep-ing and remove the ":$DATA".
     
  10. vefatica

    Joined:
    May 20, 2008
    Messages:
    8,075
    Likes Received:
    30
    Code:
    dir /f /s /: c:\users\vefatica\* | tpipe /grep=3,0,0,0,0,0,0,0,":.*:" /replace=4,0,0,0,0,0,0,0,0,":.DATA",""
     
  11. vefatica

    Joined:
    May 20, 2008
    Messages:
    8,075
    Likes Received:
    30
    A little more generic:
    Code:
    dir /f /s /: c:\users\vefatica\* | tpipe /grep=3,0,0,0,0,0,0,0,":.*:" /replace=4,0,0,0,0,0,0,0,0,":\$.*$",""
     

Share This Page