7

I got .vbs file which has alternate data stream added with notepad. is there way to send it to someone without losing that. I tried to search for answer, but it seems like that alternate data stream, can't be moved to another device. Is that correct?

Aapo Pesonen
  • 101

3 Answers3

10

They can be moved if the tools know that they need to move them.

(For example, most programs already preserve the "modification time" attribute when copying or archiving files, but that's because they were programmed to do so – it doesn't happen automatically, the program has to deliberately look up the modification time of the original, then set the same time on the copy.)

Most programs just don't care about transferring alternate streams – e.g. there is no standard format to download a file with its additional streams via HTTP (nothing similar to how MacOS Classic used to have AppleDouble and MacBinary).

But for example, file archivers can store them in an archive, it just has to be part of the program – WinRAR has an option to store alternate streams when creating .rar archives, I think 7-Zip does as well, and DISM (the tool used for installing Windows) preserves alternate streams inside .wim image files too. Of course, if you move the whole NTFS filesystem, all files will go with it, streams included.

So the options are:

  • Use a USB flash drive or some other medium formatted with NTFS, copy the file there (the standard Windows File Manager will copy all streams), then send the whole drive.

  • Use a SMB file share (hosted by Windows, or by Samba with the vfs_streams_xattr module enabled).

  • Use diskmgmt.msc to create a small virtual disk image (.vhdx file), format it using NTFS, copy the file there, then email the .vhdx file to whoever. If they're using Windows 10, they'll be able to attach the .vhdx on their system and copy files out of it.

  • Use WinRAR to create a .rar archive, and make sure to enable the option to add alternate streams, then send the .rar archive over. (Make sure the recipient also uses WinRAR to extract.)

grawity
  • 501,077
5

It all depends on what you mean by "send". Different methods of sending a file will transfer different amounts of data and metadata.

For example uploading a file to a website will strip most of its metadata, like creation and modification date, essentially leaving only data in the main stream (without ADSs) and file name.

On the other hand copying a file to a different filesystem may or may not preserve metadata, depending on filesystems in question and capabilities of the tool you're going to use.

You can copy the file to an NTFS-formatted flash drive, ensure the ADS was presesrved and mail it to your friend using snail mail. That definitely counts as sending the file, although it may not fit your needs.

Most, if not all, online tools will not send ADS.

gronostaj
  • 58,482
4

As an addendum to @user1686's answer:

  • Use 7-Zip with it's -sns Option to put the .VBS file with its ADS into a WIM container (eg. 7z a a.wim -sns *.vbs) and send that container file. And just like with WinRAR you can pack, unpack and even browse the file with ADS in 7-Zip's GUI.
    Compressing the container WIM is possible too but requires a 2nd step.
Limer
  • 471