home.social

#alternatedatastream — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #alternatedatastream, aggregated by home.social.

fetched live
  1. Dan :dumpster_fire: @[email protected] ·

    Re-sharing a 2019 article from @dfir that I just became aware of from @[email protected] -->

    Running an executable in an #AlternateDataStream ( #ADS on #NTFS ) resulted in a #prefetch file that is also in an ADS. At that time, parsing tools seemed to miss this prefetch file due to it being in an ADS. #DFIR #windows binary-zone.com/2019/05/26/cre

    This is interesting behavior. Has anyone observed this in the wild?

    #alternatedatastream #ads #ntfs #prefetch #dfir #windows