NTFS Alternate Streams

Alternate Data Streams let you hang extra hidden data off a file on NTFS - the classic filename.ext:streamname syntax. The neat thing this snippet shows is that you do not need any special API at all: the C runtime's fopen passes the stream-qualified name straight through to the filesystem, so ordinary fprintf/fgets read and write the stream just like a normal file. It makes a quick capability probe (does this drive support ADS?) and a template for stashing metadata alongside a file without touching its visible contents.

#include <windows.h>
#include <stdio.h>

int main(int argc, char *argv[])
{
    char strOut[257];
    char   strIn[257];
    FILE *StreamFile;
    const char NTFS[200] = "Failed - This drive doesn't appear to support NTFS Alternate Data Streams";

    printf("%s\n","NTFS Alternate Data Stream Input/Output Test");

    sprintf(strOut,"%s","ADS");
    sprintf(strIn,"%s","   ");

    if((StreamFile = fopen("~stream.txt:stream","wb")) == NULL)
    {
        fprintf(stderr,NTFS); exit(1);
    }

    fprintf(StreamFile,"%s\n",strOut);
    fclose(StreamFile);

    if((StreamFile = fopen("~stream.txt:stream","rb")) == NULL)
    {
        DeleteFile("~stream.txt");
        fprintf(stderr,NTFS); exit(1);
    }

    fgets(strIn,256,StreamFile);
    strIn[strlen(strIn) - 1] = '\0';
    fclose(StreamFile);

    if(strcmp(strIn,"ADS")==0)
    {
        printf("%s\n","Success - this drive supports NTFS Alternate Data Streams");
        DeleteFile("~stream.txt");
        return TRUE;
    }
    else{
        fprintf(stderr,NTFS); exit(1);
    }

    return FALSE;
}

Caveats worth knowing: streams only exist on NTFS (the failure path here is the non-NTFS case), they are invisible in Explorer and most copy tools, and DeleteFile on the base name removes the streams with it - which is exactly how the test cleans up after itself.