Hiding Files Using NTFS File Strming

NTFS file strming allows a hidden file to be crted within a legitimate file. The hidden file does not

appr in a directory listing but the legitimate file does. A user would usually not suspect the legitimate

file, but the hidden file can be used to store or transmit information.


Note: This exercise will only work on systems using the NTFS file system.

To crte and test an NTFS file strm:

1. At the command line, enter notepad test.txt.

2. Put some data in the file, save the file, and close Notepad. Step 1 will open Notepad.

3. At the command line, enter dir test.txt and note the file size.

4. At the command line, enter notepad test.txt:hidden.txt. Type some text into Notepad, save the file, and

close it.

5. Check the file size again (it should be the same as in step 3).

6. Open test.txt. You see only the original data.

7. Enter type test.txt:hidden.txt at the command line. A syntax error message is displayed.