How do you detect changes in individual NTFS Alternate Data Streams?

Since the introduction of NTFS. Since 1993 NTFS has become quite prevalent in Windows environments, especially in the Enterprise. More background info on ADS:

• http://www.securityfocus.com/infocus/1822
• http://en.wikipedia.org/wiki/Alternate_data_stream
• http://www.windowsecurity.com/articles/Alternate_Data_Streams.html
• http://www.hsc.fr/ressources/breves/ADS.html.fr (in French)
• http://www.symantec.com/connect/articles/what-you-need-know-about-alternate-data-streams-windows
• http://www.flexhex.com/docs/articles/alternate-streams.phtml

• http://technet.microsoft.com/en-us/sysinternals/bb897440.aspx
• http://nirsoft.net/utils/alternate_data_streams.html

For example. If you are running a Citrix server and your ADS detection tool finds a whole bunch of data hidden inside legitimate executables, don’t panic just yet. Read the Citrix documentation on their virtual memory optimization feature:

• http://support.citrix.com/article/ctx106023

• https://www.auscert.org.au/render.html?it=7967
• http://craigchamberlain.com/library/security/Ryan_Means_GCWN-Alt%20Data%20Streams.pdf (PDF)

Changes to the file’s content (the main stream) will result in a different checksum. A new checksum can be calculated and compared to the original one. Various algorithms are used to accomplish this:

• http://en.wikipedia.org/wiki/MD5
• http://en.wikipedia.org/wiki/SHA_hash_functions
• http://en.wikipedia.org/wiki/Tiger_(cryptography)

• http://craigchamberlain.com/library/security/Ryan_Means_GCWN-Alt%20Data%20Streams.pdf (PDF)

To confirm for yourself, take a cursor file from a Windows XP PRO SP3 system,

   c:\windows\Cursors\arrow_n.cur

confirm that it has ADS in it, using NirSoft’s AlternateStreamView utility (see link #2 in the “Tools” section above)

save the original file in a test directory as “WITH_ads.cur”

make a copy of the original in the same directory, remove the ADS from it using the NirSoft’s utility and save it as “without_ADS.cur”

then run your favorite checksum calculating utilities against those two files and confirm that both have the SAME  checksum, even though one of them has an ADS in it.

These are the screenshots from the tests with various MD5 utilities:

• http://msdn.microsoft.com/en-us/library/aa364404(VS.85).aspx

“There are no file times associated with a stream. The file times for a file are updated when any stream in a file is updated.”