Copy, delete or rename alternate data streams using only standard Windows Command prompt tools

This is a follow-up of a previous article in which I investigated some of the rather tedious ways to work with Windows alternate data streams. In this article I will give you a couple of ways to copy, delete and/or rename alternate data streams (ADS’s) in your system. Note that some of these commands may require elevated rights.

Copy alternate data streams (ads)

You cannot copy an alternate data stream the normal way. Suppose you create an ads and then copy the file, you copy the ads with it. When you try to copy just the ads, you’ll receive an error:

R:\ads>ECHO Hello world > calc.exe:my_ads.txt

R:\ads>DIR /A-D /R

06-05-2012  10:29           918.528 calc.exe
                                 14 calc.exe:my_ads.txt:$DATA
           1 File(s)        918.528 bytes
           0 Dir(s)   6.128.129.024 bytes free

R:\ads>COPY calc.exe calc_copy.exe
1 file(s) copied.

R:\ads>COPY calc.exe:my_ads.txt copy_ads.txt
calc.exe:my_ads.txt
The filename, directory name, or volume label syntax is incorrect.
0 file(s) copied.

R:\ads>COPY calc.exe:nonexisting.txt copy_ads.txt
The system cannot find the file specified.

R:\ads>DIR /A-D /R

06-05-2012  10:29           918.528 calc.exe
                                 14 calc.exe:my_ads.txt:$DATA
06-05-2012  10:29           918.528 calc_copy.exe
                            14 calc_copy.exe:my_ads.txt:$DATA
           2 File(s)      1.837.056 bytes
           0 Dir(s)   6.127.471.616 bytes free

Difference in error trying to copy an existing or non-existing alternate data stream

In the output above, the second copy command tries to copy a non-existing ads. Note the difference in the error. Copying a non-existing ads gives the same error as when copying a non-existing file:

The system cannot find the file specified.

But when you copy an existing alternate datastream, the copy-command actually finds the stream, but refuses to copy it because it doesn’t seem to understand the syntax:

The filename, directory name, or volume label syntax is incorrect.

This might come in handy when trying to find out whether a certain stream exists, because when you use the dir-command with a stream name, it will always tell you File not found.

Three types of copying for alternate data streams

Unfortunately, there’s no straightforward way for copying alternate datastreams. Since MORE is the only standard available command that takes input using the redirection operator < and since that command only works with text-files, I’ll show you different ways of copying streams depending on the type (binary / text) of ADS. The third approach, however, works for any type of stream:

1. Easily copy small text-only data streams
2. Copy large text-based data-streams
3. Copy any alternate data stream, binary or text, small or large

Workaround for copying small alternate datastreams to a file

When an alternate data stream is smaller than one command prompt screen in size, you can use the following command:

MORE < calc.exe:my_ads.txt > copy_of_ads.txt

This will create a file copy_of_ads.txt with the contents of the the ads my_ads.txt. This command doesn’t always work well with binary data or data with line-endings other than CRLF. When the command prompt doesn’t return immediately, the file is too large, in which case you can use the following workaround instead:

Workaround for copying a large text-based alternate datastream to a file

When an alternate data stream is large, and it is text-based with typical CRLF line-endings, you can create a copy almost the same way:

MORE < calc.exe:large_ads.txt > copy_of_largeads.txt

When you type this command, the command prompt will not return immediately. That is, because the more-command paginates the output and there’s no way I know of you can turn that off. Luckily, you can type the following blindly, to show the next XXX lines:

P 999999

The number can be any integer. Make it large enough to cover all lines in your file. The letters and digits you enter will not be copied to the output stream.

Workaround for copying any alternate data stream

The aforementioned workarounds are rather limited in practice, especially because the more-command introduces line-endings in places you don’t want it. From the previous post on this subject you may remember that creating symbolic links helps working with alternate data streams. Here’s a way to copy a any alternate data stream to a new file with the help of the mklink-command:

R:\ads>MKLINK ads calc.exe:my_ads.txt
symbolic link created for ads <> calc.exe:my_ads.txt

R:\ads>TYPE ads > copy_of_ads.txt

R:\ads>DEL ads

R:\ads>DIR /A-D /R

06-05-2012  10:29           918.528 calc.exe
                                 14 calc.exe:my_ads.txt:$DATA
06-05-2012  11:07                14 copy_of_ads.txt
           2 File(s)        918.542 bytes
           2 Dir(s)   6.128.490.496 bytes free

NOTE: the only unfortunate disadvantage is that creating symbolic links requires administrator privilege. If you receive the following error, restart the command prompt as administrator and you should be fine to continue:

R:\ads>MKLINK ads calc.exe:my_ads.txt
You do not have sufficient privilege to perform this operation.

You can run the above series of commands as one command as follows (place the multiple lines on one line):

MKLINK ads calc.exe:my_ads.txt
  && TYPE ads > copy_of_ads.txt
  && DEL ads

Deleting alternate data streams

Where copying alternate data streams is still quite doable, deleting alternate data streams really gets painful. Again I should advice you to use any of the existing third party tools to make this process more straightforward. However, if you want to know how you can do this with just the tools that Microsoft provides you in a standard Windows installation, there are essentially three scenarios we need to consider:

1. Delete all alternate data streams from a file
2. Remove the contents of one alternate data stream
3. Delete one alternate data stream from a file

Workaround to delete all alternate datastreams from a file

You can delete all alternate data streams from a file by copying the file to a volume that doesn’t support ads’s. A volume formatted as FAT or FAT32 suffices this predicate.

But you won’t always have a FAT volume handy. And creating a virtual FAT drive just to delete alternate data streams is too much of an effort. Instead, use the following trick:

TYPE file_with_ads.exe > file_without_ads.exe
MOVE /Y file_without_ads.exe file_with_ads.exe

The first command-line creates a new file without the streams attached, because TYPE only echoes the contents of the file and not the streams. The second line copies it over the original. The /Y parameter suppresses the overwrite-permission question.

Remove the contents of one alternate data stream

To remove the contents of just one alternate data stream, you can use the following simple command:

TYPE NUL > calc.exe:my_ads.txt

Since the early days of MS-DOS, NUL has been around as a garbage can when you don’t want to store or display output of a command. But since this special “file” is always empty, you can use it like above to create a zero-byte file, or in this case, overwrite an ADS with nothingness.

Delete only one alternate data stream from a file with multiple streams

The only way I can think of for doing this is to follow these steps:

1. List all streams for a given file
2. Make a copy of each data stream using the mklink workaround mentioned above
3. Delete all data streams from the file
4. Copy back all data streams, except the one you wanted to delete

Doing all these steps with one command is daunting. Using some listing with DIR /R for the first step, we then need to filter out the streams. We should feed the output to a MKLINK command to temporarily create symbolic links to the streams, make a copy of each of them, remove the streams on the original file and copy back the streams, except the one we wanted to delete.

Since this is far from trivial, I leave that as an exercise to myself for a later moment. If you have a better idea, I’d be happy to hear from you.

Renaming alternate data streams

The simple task of renaming an alternate data stream is the culmination of all the hardest workarounds we have seen so far. You need to do the following:

1. Make a copy of each data stream using the mklink workaround mentioned above
2. Delete all data streams from the file
3. Copy back all data streams, except the one you want to rename
4. Copy back the done data stream that you want to rename using the new name

For the same reason as for deleting only one data stream, I’ll have to take a raincheck for the time being on this one, but I’ll come back with a batch-file solution (doing this by hand becomes tedious and ridiculous).