Usage

Navigation: Command Line Applications > ADSList >

Usage

Command Line Parameters

adslist <DIRECTORY> /s /q

DIRECTORY	The directory to analyze, uses the current directory if none is specified
/s	Include sub directories
/q	Quiet output, omit headers, omit error messages and only prints text when alternate data streams are found

You can schedule adslist.exe using the EventSentry Application Scheduler, which can analyze the return code and output of the utility and only log an event to the event log when one or more alternate data streams have been found.

Examples

Example 1: Look for alternate data streams in the %SYSTEMROOT% directory, including sub directories

adslist %SYSTEMROOT% /s

Example 2: Look for the alternate data streams in the C:\Windows\System32, including sub directories, and use the quiet output

adslist C:\Windows\System32 /s /q

Sample Output

C:\>adslist C:\ /s

---------------------------------------------------------------

ADSList v1.0 by NETIKUS.NET ltd [ compiled on Jul 27 2008 ]

(support@netikus.net)

---------------------------------------------------------------

List alternate data streams on NTFS volumes.

0001: C:\\Documents and Settings\Administrator\Favorites\Download details Feature Pack for SQL Server 2005 Nov 2005.url

favicon

0002: C:\\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\68B6GYDG\LSSetup_en_US[1].exe

Zone.Identifier

0003: C:\\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\CUQF6SXR\launch[1].lsf

Zone.Identifier

0004: C:\Images\temp\logo_v2_white.png

?Q30lsldxJoudresxAaaqpcawXc

{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}

0005: C:\Images\logo_v2_white.jpg

?Q30lsldxJoudresxAaaqpcawXc

{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}

Summary:

========

Time elapsed: 5 second(s)

Files Processed: 66680

Files with alternate data streams: 5

Alternate Data Streams found: 7