A stream is a sequence of bytes. NTFS stores files as collections of attributes inside Master File Table (MFT) records.

MFT Records

A typical file record looks like this:

MFT record for hm.txt
├── $STANDARD_INFORMATION
├── $FILE_NAME
├── unnamed $DATA
└── named $DATA called "secret"

Stream Sizes

Each stream has:

The allocation size is the amount of disk space that is reserved for a stream.
The actual size is the number of bytes that are being used by a caller.
The valid data length (VDL) is the number of bytes that are initialized from the allocation size for the stream.

Stream Names

The full name of a stream is _filename_:_stream name_:_stream type . Users can only use existing stream types. The default data stream is unnamed.

Stream Types

Stream Type	Description
`::$ATTRIBUTE_LIST`	Contains a list of all attributes that make up the file and identifies where each attribute is located.
`::$BITMAP`	A bitmap used by indexes to manage the b-tree free space for a directory. The b-tree is managed in 4 KB chunks (regardless of cluster size) and this is used to manage the allocation of these chunks. This stream type is present on every directory.
`::$DATA`	Data stream. The default data stream has no name. Data streams can be enumerated using the FindFirstStreamW and FindNextStreamW functions.
`::$EA`	Contains Extended Attributes data.
`::$EA_INFORMATION`	Contains support information about the Extended Attributes.
`::$FILE_NAME`	The name of the file, in Unicode characters. This includes the short name of the file as well as any hard links.
`::$INDEX_ALLOCATION`	The stream type of a directory. Used to implement filename allocation for large directories. This stream represents the directory itself and contains all of the data of the directory. Changes to streams of this type are logged to the NTFS change journal. The default stream name of an $I N D E X_{A} LL O C A T I O N s t r e am t y p e i s$ I30 so “DirName”, “DirName:: $I N D E X_{A} LL O C A T I O N ", an d "_{D} i r N am e_{:}$ I30:$INDEX_ALLOCATION” are all equivalent.
`::$INDEX_ROOT`	This stream represents root of the b-tree of an index. This stream type is present on every directory.
`::$LOGGED_UTILITY_STREAM`	Similar to :: $D A T A b u t o p er a t i o n s a r e l o g g e d t o t h e N T F S c han g e j o u r na l . U se d b y E F S an d [T r an s a c t i o na l N T F S (T x F)] (h ttp s : // l e a r n . mi cr oso f t . co m / e n - u s / w in d o w s / w in 32/ f i l e i o / t r an s a c t i o na l - n t f s - p or t a l) . T h e " :_{S} t r e am N am e_{:}$ StreamType” pair for EFS is “: $E F S :$ LOGGED_UTILITY_STREAM” and for TxF is “: $T X F_{D} A T A :$ LOGGED_UTILITY_STREAM”.
`::$OBJECT_ID`	An 16-byte ID used to identify the file for the link-tracking service.
`::$REPARSE_POINT`	The reparse point data.

List Alternate Streams

# display alternate streams on Windows
cmd /c "dir /r"

Cyber Reference

Explorer

file-streams

MFT Records

Stream Sizes

Stream Names

Stream Types

List Alternate Streams

Graph View

Table of Contents