AltStreamOverlay - A windows shell extension to show NTFS alternate stream information.
Update 09/2012 - People were asking for a 64 bit version - This is now in the binaries zip
This is a little tool I knocked up in the course of investigating NTFS alternate streams - there's some very good documentation out there, but I couldn't find a decent explorer plugin.
What are alternate streams?
Flexhex has some excellent documentation on alternate streams, so I won't overly bore you, but in summary - NTFS (the filesystem used in Windows since NT) allows a file to contain more than one data stream. The primary one is the one you're used to seeing, but there can be more.
Where might they be used?
Any number of reasons - for example, internet explorer adds an extra stream to files to tell where they've been downloaded from!
So what's this?
AlternateStreamOverlay (I don't do catchy names) is an explorer plugin (tested on XP 32 bit and windows 7 (32+64bit), so it'll probably work for you), which will detect the presence of aternate streams in files and
- Show an overlay icon to indicate Alternate streams exist
- Allow you to list alternate streams in the context menu
- Allow you to browse the content of the alternate streams in the properties of the file.
Looking at a directory with a file downloaded with internet explorer - note the superimposed fingerprint over the icon.
The context menu now shows (if applicable) a list of the alternate streams.
This file was downloaded using Internet Explorer - it's added an extra stream "Zone.Identifier" to supply metadata about where the file came from.
Note : If this fails to register, then you may not have the vc2008 runtimes. Get them here (x86) or here (x64)
Minor rev - 22.214.171.124 - Added 64 bit version
Minor rev - 126.96.36.199 - Display alternate streams for directories. (thanks rmeyr)