Alternate data streams

[Jibby]

I have recently been reading up on iStreams in Kaspersky AV v5, and it looks like KAV writes its own alternate data streams (ADS) as part of optimising real-time scanning performance if I understand correctly. Unfortunately I'm still trying to understand exactly how ADS works, but what I'm a bit concerned with at the moment is this... files that I've backed up on CDs/DVDs, are the ADSs associated with these files backed up too (which is probably something I don't want)? Or are the ADSs and the file they're associated with actually separate files altogether?

 

[cleverhandle]

Originally posted by: Jibby
files that I've backed up on CDs/DVDs, are the ADSs associated with these files backed up too

Yes.

(which is probably something I don't want)?

Why not?

Or are the ADSs and the file they're associated with actually separate files altogether?

The ADS is part of the file.

 

[Jibby]

Hi cleverhandle, thanks for the reply! I've asked the same question over at the Wilders Security Forum, and a couple of the members have said that the ADSs are backed up on the CDs/DVDs, but another member jumped in and said that isn't the case. I dug around on the net a bit and found the following:

From http://www.wikistc.org/wiki/Alternate_data_streams :

ISO 9660, FAT, ext2, all will not support alternate data streams so moving a file or directory to any of these and back will strip all but the unnamed default stream.

From http://ben.staging.popart.com/PermaLink...16479-c9af-4840-9e59-56eb00310eb2.aspx :

You lose the streams if you email it or transport the file off to file systems formats that do not supports streams (like ISO 9660, etc).

...

I haven't seen any CD formats that support this but I really haven't look long and hard for one. Perhaps, someone reading this can chime in.

So now I'm a little confused as to whether the files I've previously burnt on to CDs/DVDs have ADSs in them.

 

[Jibby]

And regarding why I'm hoping to backup files on to CDs/DVDs without ADSs... I am aware Windows sets its own ADSs, so one would hope that in future versions of Windows there shouldn't be any problems with the Windows-set ADSs.

I am more concerned with the ADSs that Kaspersky 5 set. From what I've been told at the Wilders Security Forum, when I uninstall Kav 5 (probably will be switching over to kav 6 soon, and kav 6 does not have iStreams and doesn't set its own ADSs), I'll have the option to have the ADSs Kav5 set removed.

But what about the files I've burnt previously from that computer on to CDs/DVDs? It'll be a minor inconvenience to have to transfer everything from those CDs/DVDs on to my computer (might have enough disk space...) prior to uninstalling kav 5. However, if it has to be done then of course I'm happy to do it.

To be honest I don't know what, if any, sort of problems might occur in the future if I don't remove the kav5-set ADSs. I'm just taking the approach of "better to be safe than sorry," I guess.

 

[cleverhandle]

Originally posted by: Jibby
ISO 9660, FAT, ext2, all will not support alternate data streams so moving a file or directory to any of these and back will strip all but the unnamed default stream.

Yes, that makes sense. I wasn't thinking enough about it. Having an ADS is only possible with support from the filesystem - put the file on a non-ADS-capable filesystem (everything but NTFS, maybe HFS?), and you lose that information. Just like copying an NTFS file to a FAT partition and losing permissions information.

I still don't see what the problem would be with having ADS info in the files, though. I haven't looked at exactly how KAV uses ADS, but I'm guessing it's just some simple metadata - scan date, maybe a checksum, that kind of thing. It's not going to hurt anything if it gets left over after uninstalling KAV5.

 

[Jibby]

Thanks cleverhandle! Alright, so I may not have to worry after all about transferring files I've backed-up back on to my computer before uninstalling kav 5.

What do you think of the following comment from http://ben.staging.popart.com/PermaLink...16479-c9af-4840-9e59-56eb00310eb2.aspx :


I haven't seen any CD formats that support this but I really haven't look long and hard for one. Perhaps, someone reading this can chime in.

Would also like to say that I am not insinuating that there are indeed any problems with having the ADSs retained when I back things up on CDs/DVDs. It's because I don't fully understand them hence why I'm taking that "better to be safe than sorry" approach.