How can a hidden text document within an NTFS Alternate Data Stream be accessed?

• A. Notepad to access the ADS with path c:file1:file2.txt
• B. Use Regedit
• C. Use a hex editor
• D. Use a dedicated ADS viewer

Answer: (A)

NTFS stores extra data in hidden streams attached to a file, called alternate data streams. You access an ADS by appending a colon and the stream name to the file’s path. Because Notepad is a plain text editor, you can read the ADS content by opening the file path with the stream name included, for example C:\path\to\file.txt:hiddenStream. If the stream contains text, Notepad will show it directly. This is the simplest, built-in way to view a textual ADS. Regedit isn’t relevant to ADSs, which live in files rather than the registry. A hex editor could read the raw data but is more cumbersome and unnecessary for text. A dedicated ADS viewer exists, but Notepad provides the quickest access using the correct path syntax.