Alternate Streams

An NTFS file can have several independent data streams – one unnamed and any number of named ones. The unnamed stream always present (although it can be of zero length); named streams are optional. You can consider an NTFS file a set of independent "files" all having the same name and attributes.

A customary 'non-streamed' file is simply a file that has an unnamed stream only, and most files in fact don't have named streams. However some files do.

It is unlikely that you would notice that some file has an alternate named stream, because the Windows Explorer, like many other programs, ignores alternate streams. For example, the Windows Explorer can report a file having zero length even if the file has several gigabytes of data in a named stream (of course, copying such a "zero length" file would take considerable time).

A simple example of a multi-stream file is a file with summary information. Right-click any file, select the Properties item, and open the Summary tab. Enter some summary info and press OK.

Now open the file with FlexHEX and you will notice that Windows created several alternate streams. In our simple example the Stream pane will look as on the screenshot below:

We can see here that in addition to the main unnamed stream the file has three named streams containing the summary information.

You can use the commands in the program's Stream menu to create, delete, and rename file streams.