ADSman

ADSman is a command-line tool for managing Alternate Data Streams (ADS) on NTFS file systems. It allows users to find, add, remove, and extract ADS from files.

What is ADS?

Alternate Data Streams (ADS) are hidden data layers within files on NTFS file systems. Unlike regular file contents, ADS are not visible in File Explorer or standard directory listings. They allow additional data to be stored within a file without changing its size in the main view.

Why does ADS exist?

• Originally designed for compatibility with macOS metadata when NTFS was introduced.
• Used by Windows system features for storing extra file information.
• Sometimes exploited by malware to hide malicious payloads inside seemingly harmless files.

How does ADS work?

• A file can have multiple ADS attached to it.
• ADS are accessed using the format: filename:streamname

Usage

ADSman.exe [--target/-t <target>] [--find/-f] [--add/-a <source>] [--remove/-r <name>] [--extract/-e <name>] [--nobanner/-n] [--help/-h]

Options

• -h, --help Display this help menu and exit.
• -n, --nobanner Suppresses the banner.
• -t, --target <file> Target file to operate on.
• -f, --find Find ADS in the target file.
• -a, --add <file> Add a file as an ADS to the target.
• -r, --remove <name> Remove an ADS from the target by name.
• -e, --extract <name> Extract an ADS from the target by name.

Download exe for Windows

This tool is part of the 8gudbitsKit project. To download the executable for Windows, visit the 8gudbitsKit repository.

For the Tech People

• Uses Windows API (FindFirstStreamW, FindNextStreamW) to detect ADS.
• Reads and writes ADS using std::ifstream and std::ofstream.
• Supports adding, extracting, and removing ADS using NTFS stream paths.
• Handles wide-character filenames for full Windows compatibility.
• Ensures safe ADS removal using DeleteFileW().
• Provides detailed output to help users understand ADS presence.