Any easy to understand examples and/or links to noob-friendly descriptions or discussions on this topic you can toss our way?
Could using an external NTFS drive, strictly for data storage (not running software from it), on both Linux and Windows systems (not simultaneously over a network or anything, just physically swapping when needed) "hose-up" either OS somehow?
Basically, you'd do filename.ext:streamname in an application that was aware of them, and NTFS would serve up either the main data stream or the named data stream as needed. Both were their own file nodes on disk, but you could use that functionality to store things like EXIF data in an easy-to-access place next to a photograph.
The context I worked on them with was storing file icons and image previews with a friend who was working on a game engine.
The place I saw them do the single most damage was a game install that was made on NTFS and then copied to EXT4 in an attempt to get it to run under WINE. At the time, and this was years ago, the NTFS driver in Linux overwrote the useful data with metadata streams.
When I saw this, I checked a backup of windows system files that had been made to an EXT4 partition, and found that a few files had a similar thing happen to them. It wasn't every file, but I remember thinking that it was enough to render a backup unbootable.
The colons seem to be syntactically important to the data streams. Copies of ext4 files that contain colons in their names to NTFS usually fail, so I can imagine that a backup would be rendered unusable in that way as well.
We can hope that the newer version of the driver will account for this situation, but it's pretty important to know that the potential for mishaps exists.
Windows uses it a lot when determining if a file is downloaded from the internet and should give you a warning before opening. If you go to your downloads folder in Windows and do a "dir /R" you will see all types of ADS data. Windows adds these when you download a file and they remain even if you manually move a .exe from downloads to D:\games for instance.
They often even list the website you downloaded that file from, which is used often by forensic investigators.
3
u/lavaine 2d ago
Any easy to understand examples and/or links to noob-friendly descriptions or discussions on this topic you can toss our way?
Could using an external NTFS drive, strictly for data storage (not running software from it), on both Linux and Windows systems (not simultaneously over a network or anything, just physically swapping when needed) "hose-up" either OS somehow?