Alternate Data Streams

# Find and analyze Zone.Identifier streams on the live system
# Also works on files extracted from disk images (copy to analysis workstation first)

# List all files with ADS in a directory
Get-ChildItem -Path "C:\Users\jsmith\Downloads" -Recurse |
    Get-Item -Stream * |
    Where-Object { $_.Stream -ne ':$DATA' } |
    Select-Object FileName, Stream, Length |
    Format-Table -AutoSize

# Read Zone.Identifier for a specific file
Get-Content "C:\Users\jsmith\Downloads\invoice.exe" -Stream "Zone.Identifier"
# Output:
# [ZoneTransfer]
# ZoneId=3
# ReferrerUrl=http://evil-phish-site.com/
# HostUrl=http://evil-phish-site.com/invoice.exe

# ZoneId values:
# 0 = Local Computer (no web download)
# 1 = Local Intranet
# 2 = Trusted Sites
# 3 = Internet (most common for malware downloads)
# 4 = Restricted Sites

# Bulk Zone.Identifier analysis — find all internet-zone downloads
Get-ChildItem "C:\Users" -Recurse -File -ErrorAction SilentlyContinue |
    ForEach-Object {
        try {
            $zone = Get-Content $_.FullName -Stream "Zone.Identifier" -ErrorAction Stop
            if ($zone -match "ZoneId=3") {
                $refUrl = ($zone | Select-String "ReferrerUrl=").Line -replace "ReferrerUrl=", ""
                $hostUrl = ($zone | Select-String "HostUrl=").Line -replace "HostUrl=", ""
                [PSCustomObject]@{
                    File        = $_.FullName
                    Modified    = $_.LastWriteTime
                    ZoneId      = 3
                    ReferrerUrl = $refUrl
                    HostUrl     = $hostUrl
                }
            }
        } catch {}
    } | Export-Csv "D:\analysis\zone-identifier.csv" -NoTypeInformation

IMAGE="/cases/CASE-2026-009/FINANCE-SRV01.E01"
OFFSET=2048

# fls -a shows alternate data streams (ADS) in file listings
fls -a -o $OFFSET $IMAGE -r | grep ":" | grep -v ":$DATA\|:$I30\|:$ObjId\|:$REPARSE_POINT\|:$Security_Id"
# The grep filters out common NTFS metadata streams
# Remaining : entries are user-created or interesting named streams

# icat to extract the ADS content
# Zone.Identifier stream inode syntax: inode-stream
# Get the inode from fls, then specify the stream
fls -r -o $OFFSET $IMAGE | grep "invoice.exe"
# → r/r 123456-128-1: invoice.exe
# ADS for that file:
# r/r 123456-128-3: invoice.exe:Zone.Identifier

# Extract Zone.Identifier content:
icat -o $OFFSET $IMAGE 123456-128-3

# MFTECmd also reports ADS in its CSV output
# HasAds column = True means the file has named streams
# IsAds column = True means this row is an ADS entry (not the main file)

# From KAPE-collected MFT:
MFTECmd.exe -f "$TRIAGE\C\$MFT" --csv "$OUT\mft" --csvf mft.csv

# In PowerShell, filter for ADS entries:
$mft = Import-Csv "$OUT\mft\mft.csv"
$mft | Where-Object { $_.IsAds -eq "True" } |
    Select-Object FileName, ParentPath, FileSize, Created0x10 |
    Where-Object { $_.FileName -notmatch "^\:(\$|REPARSE|ObjId|Security)" } |
    Format-Table -AutoSize