You are currently offline, waiting for your internet to reconnect

How To Use NTFS Alternate Data Streams

This article was previously published under Q105763
The documentation for the NTFS file system states that NTFS supportsmultiple streams of data; however, the documentation does not addressthe syntax for the streams themselves.

The Windows NT Resource Kit documents the stream syntax as follows:
Alternate data streams are strictly a feature of the NTFS file systemand may not be supported in future file systems. However, NTFS will besupported in future versions of Windows NT.

Future file systems will support a model based on OLE 2.0 structuredstorage (IStream and IStorage). By using OLE 2.0, an application cansupport multiple streams on any file system and all supported operatingsystems (Windows, Macintosh, Windows NT, and Win32s), not just Windows NT.
The following sample code demonstrates NTFS streams:

Sample Code

   #include <windows.h>   #include <stdio.h>   void main( )   {      HANDLE hFile, hStream;      DWORD dwRet;      hFile = CreateFile( "testfile",                       GENERIC_WRITE,                    FILE_SHARE_WRITE,                                NULL,                         OPEN_ALWAYS,                                   0,                                NULL );      if( hFile == INVALID_HANDLE_VALUE )         printf( "Cannot open testfile\n" );      else          WriteFile( hFile, "This is testfile", 16, &dwRet, NULL );      hStream = CreateFile( "testfile:stream",                                GENERIC_WRITE,                             FILE_SHARE_WRITE,                                         NULL,                                  OPEN_ALWAYS,                                            0,                                         NULL );      if( hStream == INVALID_HANDLE_VALUE )         printf( "Cannot open testfile:stream\n" );      else         WriteFile(hStream, "This is testfile:stream", 23, &dwRet, NULL);   }				
The file size obtained in a directory listing is 16, because you arelooking only at "testfile", and therefore
type testfile
produces the following:
   This is testfile				
type testfile:stream
produces the following:
   The filename syntax is incorrect				
In order to view what is in testfile:stream, use:
more < testfile:stream
mep testfile:stream
where "mep" is the Microsoft Editor available in the Platform SDK.

Article ID: 105763 - Last Review: 11/21/2006 15:41:00 - Revision: 4.2

  • Microsoft Win32 Application Programming Interface
  • kbhowto kbapi kbkernbase kbfileio KB105763