No navigation frame on the left?  Click here.

NTFS streams

 

NTFS supports multiple data streams, a bit like the two forks that a Macintosh file has. What the user sees as a "file" is the unnamed stream, internally named "::$DATA". Other streams must be named, like this: "\mydir\myfile.txt:mystream". Incidentally, the Macintosh resource fork for a file stored on an NT Server running Services For Macintosh is stashed away in a stream named ":AFP_Resource".

Two ways for listing streams within a file are shown; one uses the documented BackupRead() function, which is sl-o-o-w; the other one uses a not-really-documented function, but it is faster.

The other application for streams is the creation of hard links, which are a type of Posix-style file links, and the lnw sample shows you how to do that.

Here we go:

bulletTwo ways to enumerate NTFS streams
bulletCreating hard links on NTFS