I recently did a CTF involving a file on a samba share which had a password in an alternate data stream. To read it I had to connect using Windows, but I'm curious if there's any way to read ADS from linux, either using SMBclient or another tool.

2 Answers 2


Found a way to do this without mounting the drive.

smbclient -U USER //IP/Share -c 'allinfo "ADS_FILE"' followed by get "ADS_FILE:PASSWORD:$DATA" downloads the file.

  • $DATA is the file data. ADS is not required here - this is what you get if you just open the file.
    – harrymc
    Jan 26, 2020 at 12:09
  • Well this gave me what I needed, whereas just downloading the file was empty.
    – clubby789
    Jan 26, 2020 at 12:10
  • I think there was a problem in the Samba configuration, but that's another subject.
    – harrymc
    Jan 26, 2020 at 12:14
  • 1
    The stream name is "PASSWORD" and the stream type is "$DATA". The default stream has no name and type $DATA.
    – spxl
    Apr 29, 2020 at 19:02

Reading Alternate Data Streams (ADS) is possible when using ntfs-3g:

NTFS stores all data in streams. Every file has exactly one unnamed data stream and can have many named data streams. The size of a file is the size of its unnamed data stream. By default, ntfs-3g will only read the unnamed data stream.

By using the options "streams_interface=windows", with the ntfs-3g driver (not possible with lowntfs-3g), you will be able to read any named data streams, simply by specifying the stream's name after a colon. For example:

cat some.mp3:artist 

Named data streams act like normal files, so you can read from them, write to them and even delete them (using rm). You can list all the named data streams a file has by getting the "ntfs.streams.list" extended attribute.

  • This looks like what I need. But is it possible to use this to mount over a network?
    – clubby789
    Jan 26, 2020 at 11:56
  • If you can mount it using ntfs-3g, then it should work.
    – harrymc
    Jan 26, 2020 at 12:08
  • It didn't accept //IP/Share as a valid mount image
    – clubby789
    Jan 26, 2020 at 12:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .