Versions:
AlternateStreamView version 1.58 from Nir Sofer is a lightweight security-oriented utility designed to expose, extract and eliminate hidden NTFS Alternate Data Streams (ADS) that are otherwise invisible in Windows Explorer. By recursively scanning any local or removable NTFS volume, the program compiles a detailed list of every file that carries one or more alternate streams, showing stream name, size, full path and creation time in a single sortable grid. Users can then selectively copy selected streams to a chosen folder for forensic inspection, delete suspicious or orphaned streams to reduce attack surface, or export the complete enumeration to plain-text, HTML, CSV or XML reports for documentation or further analysis. Because many types of malware and privacy leaks rely on ADS to conceal payloads or metadata, the tool is frequently deployed during incident response, penetration-testing clean-up, pre-deployment hardening of master images, and routine audits of downloaded archives, e-mail attachments and browser downloads. Digital forensics specialists also value its ability to reveal document summary information or web-mark of the web tags that Windows would normally hide. The portable executable requires no installation and runs on every NT-based edition from Windows XP to Windows 11, consuming negligible memory even when indexing multi-terabyte drives. AlternateStreamView is available for free on get.nero.com, with downloads provided via trusted Windows package sources (e.g. winget), always delivering the latest version, and supporting batch installation of multiple applications.
Tags: