About NTFS Data Streams

Thinking about working with NTFS data streams? Keep the following points in mind.

  1. In Windows 2000 and Windows NT 4.0, only NTFS partitions support multiple data streams. If you try to access a hidden stream on a FAT partition, you receive an error message such as File not found or The filename, directory name, or volume label syntax is incorrect. Computers running Windows 9x can read and write hidden streams but only on remote servers that have NTFS partitions.
  2. If you copy or move a file containing hidden streams to another NTFS partition on the same server or another server, you retain the hidden streams. If you copy or move a file containing hidden streams to a FAT partition in NT 4.0, you lose the hidden streams with no warning. If you copy or move a file containing hidden streams to a FAT partition in Win2K, you receive a warning that specifies the names of the hidden streams you're about to lose. If you copy a file containing hidden streams to removable media (e.g., a 3.5" disk), you lose the hidden streams.
  3. When you input data into a hidden stream, the specified file size (i.e., Size in Windows Explorer) doesn't increase. However, the space available on the drive decreases because the file system uses more space to retain the additional stream information. As a result, you can exhaust the space on a drive while the files' total space remains less than the drive's capacity. Thus, you need to use discretion when creating streams.
  4. Any type of file (e.g., .jpg, .doc, .bat) can have a hidden stream. This feature can be very useful if you want to track file information that the file system usually doesn't track (e.g., version number, author, last approval date).
  5. When you create or modify a hidden or visible stream, the file's Modified date in Windows Explorer changes.
  6. Backup systems generally support hidden streams. For example, both VERITAS Software's and Legato Systems' backup solutions back up and restore files with the hidden streams intact.
  7. Like files, folders have hidden streams that you can use. However, the More command and WordPad don't work with folder hidden streams. Instead, you need to use the For command or Notepad to view and edit folder hidden streams. For example, to create a folder hidden stream, you can use the code
Echo Here is a hidden stream in a folder > C:\Temp:OpenSesame.txt
Echo with a .txt stream extension. >> C:\Temp:OpenSesame.txt

To read this hidden stream with Notepad, you can specify


To read this hidden stream at the command line, you can use the For command:

For /f "Tokens=*" %i in (C:\Temp:OpenSesame.txt) Do @Echo %i
Hide comments


  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.