Remove only one alternate data stream from a file that contains multiple ADS’s using basic DOS commands

In a previous post on deleting alternate data streams from files, I promised to come back to the subject. Limiting yourself to the tools provided by Microsoft Windows makes it quite hard to delete a single alternate data stream from a file when multiple streams are attached to that file. However, it is not impossible. But like before, unless you have a reason not to install third party tools, I suggest you take a look at streams.exe by SysInternals/Microsoft or this graphical utility from Nirsoft (but Google will find you more alternatives).

Previous articles in this series

• A hands-on guide to manipulating alternative data streams
• Copy, delete or rename alternate data streams

Single command for deleting one alternate data stream

To cut to the chase at once, the following command (place it on one line!) will delete only one named alternate data stream from your file and leave the others alone:

FOR %P IN (filewithads.ext)
  DO
    @ECHO OFF &&
    DIR /r
       | find ":$DATA"
       | find /V ":ads_to_delete"
       > _streams.txt &&
    ECHO 1
       >> _streams.txt &&
    FOR /f "tokens=1,2,3 delims=: " %h IN (_streams.txt)
      DO
        IF %h NEQ 1
          (MKLINK %i_%j %i:%j >NUL &&
          TYPE %i_%j > copy_%i_%j &&
          DEL %i_%j &&
          TYPE copy_%i_%j > tmp_%i:%j &&
          DEL copy_%i_%j)
        ELSE
          (TYPE %P >> tmp_%P &&
          DEL %P &&
          REN tmp_%P %P &&
          ECHO ON)

For convenience, I copy the same command here as one line. Double-click it to select all, then use Ctrl-C to copy it to paste it later to your command line:

FOR %P IN (filewithads.ext) DO @ECHO OFF && dir /r | find ":$DATA" | find /V ":ads_to_delete" > _streams.txt && ECHO 1 >> _streams.txt && for /f "tokens=1,2,3 delims=: " %h IN (_streams.txt) DO IF %h NEQ 1 (MKLINK %i_%j %i:%j >NUL && TYPE %i_%j > copy_%i_%j && DEL %i_%j && TYPE copy_%i_%j > tmp_%i:%j && DEL copy_%i_%j) ELSE (TYPE %P >> tmp_%P && DEL %P && REN tmp_%P %P && ECHO ON)

 Usage

• Copy the above line to your commandline;
• Replace filewithads.exe with the filename that contains the alternate data streams;
• Replace ads_to_delete with the name of the alternate data stream;
• Run the command (Enter);
• Use DIR /R to check whether everything was successful.

Step by step explanation

If you read the previous posts, you already know that it is next to impossible to manipulate alternate data streams from the command prompt or essentially from anywhere else in Windows. This monstruous command works around those limitations to do a task that proofed hardest of all: deleting a single alternate data stream from a file.

Rest TBD.