Using Linux to handle NTFS Alternative Data Streams

Using Linux to handle NTFS Alternative Data Streams

♥️ SUBSCRIBE for more videos: https://www.youtube.com/bluemonkey4n6?sub_confirmation=1

Difficulty Level: Intermediate
Prerequisites: basic understanding of linux command line
Prerequisites: basic understanding of filesystems
Prerequisites: basic understanding of NTFS’s Alternative Data Streams

In this video, we will look at using Linux to access the hidden files within NTFS using Alternate Data Streams.

Video timeline
00:00 intro
00:45 Accessing alternate data streams the wrong way
03:15 streams_interface=windows
08:28 getfattr – get extended attributes from filesystem
09:46 streams_interface=xattr
12:51 Using the sleuth kit on image files

⭕️ For the Windows intro to Alternate Data Streams, watch this video here: https://youtu.be/p16Gatbav-E

Other videos which the bluemonkey4n6 AI engine believes you would enjoy:
Reading Linux filesystems with Windows: https://youtu.be/NZZnb7ocHbw
Windows Live Capture: https://youtu.be/oPAIm5VVHJI
Disabling automount in Windows: https://youtu.be/CxFBOvSNw6Q
Write-protect USB and hard drives: https://youtu.be/uQP8jmm1Sqo
Bootable Windows Environment for forensics: https://youtu.be/G45my7uQwTM

Linux distro:
CAINE  linux (http://www.caine-live.net)

Sleuth Kit downloads: https://github.com/sleuthkit/sleuthkit/releases

Icons made by freepik from @flaticon http://www.flaticon.com/authors/freepik

Icons made by Smashicons from @flaticon http://www.flaticon.com/authors/smashicons

Music by Lensko: Let’s Go

DISCLAIMER: Links in this video description might be affiliate links. If you purchase a product or service using one of these links, I may receive a small commission at no additional cost to you. Thank you!

#DFIR #linux #alternatedatastreams