0

I can create a file with a colon : in the name. I am given to understand this should not be possible in Windows. I originally did it by copying text with a colon : into the filename to save a text file with Notepad++. I can open the file with Notepad++ if I know the exact name. There is a file named the same as the text before the colon : and properties shows the Size is 0 bytes, but the Size on disk appears to be the same as the size of the file if saved without a colon :.

I reproduced with Set-Content and Get-Content in PowerShell.

Set-Content -Path .\test:test.txt -Value "colon filename test"
Get-Content -Path .\test:test.txt

Returns:
colon filename test
Note this small file shows 0 bytes on disk, unlike the larger 44 kb file saved from Notepad++.

Get-ChildItem only shows the pseudo folder with 0 length.

Remove-Item -Path .\test:test.txt works, but the pseudo folder remains.
It must also be removed with Remove-Item -Path .\test.

I'm running Windows 10 and PowerShell 5.1.

1

This is not anything new and has nothing to do with Powershell.

Your position of:

'I can create a file with a colon : in the name which should not be possible in Windows.'

... is not valid.

This has been possible in WIndows for decades. It's called ADS (Alternate Data Streams) and this is not a folder, but simply extra data (text. pictures, etc.) embedded/appended/hidden in the data file. This is a well-documented thing. ADS will never increase the original file size, by design.

This is also a security thing called Steganography, and yes, when you use such techniques, you need to know exactly what the stream name is.

Just do a search for 'Windows Alternate Data Streams' or 'windows alternate data streams view' and you'd get lots of hits on what it is, why it exists, how to do it and how to read them.

You can just use the Microsoft SysInternals tool called streams.exe to see them as well.

https://www.bleepingcomputer.com/tutorials/windows-alternate-data-streams

You could also just search for PowerShell read 'alternate data streams' to see how to read them.

Lastly, as for this...

'Remove-Item -Path .\test:test.txt works, but the pseudo folder remains.'

... that too is not valid. When you delete the main file, anything associated with it is removed, since it only exists because the main file exists.

There is a difference between removing the ADS and deleting the whole file.

$TargetPath = 'D:\Test\ADSStuff'
Set-Content -Path "$TargetPath\test:test.txt" -Value "colon filename test"
Get-ChildItem -Path $TargetPath -Recurse
Get-Content -Path "$TargetPath\test:test.txt"
# colon filename test
Remove-Item "$TargetPath\test" -Force
Get-ChildItem -Path $TargetPath -Recurse
Get-Content -Path "$TargetPath\test:test.txt"
<#
Get-Content : Cannot find path 'D:\Test\ADSStuff\test:test.txt' because it does not exist.
At line:1 char:1
+ Get-Content -Path "$TargetPath\test:test.txt"
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (D:\Test\ADSStuff\test:test.txt:String) [Get-Content], ItemNotFoundException
    + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetContentCommand
#>
| improve this answer | |
  • My following statement seems accurate given your description, though the "pseudo folder" terminology is inaccurate. Remove-Item -Path .\test:test.txt works, but the pseudo folder remains. It must also be removed with Remove-Item -Path .\test. – jbreving Apr 13 at 13:56
  • Yes, you can add and remove ADS whenever to an existing file. Yet, you must remove the file to delete it all. Again, ADDS has been used for decades. Anytime you download a file from the public internet, and ADS stream is part of that. It's called a ZoneIdentitfier. This is why when you click such a file in Explorer, there is an unblock option. This is also why the Unblock-File cmdlet exists. docs.microsoft.com/en-us/powershell/module/… --- to Remove the ADS/ZoneIdentifier. – postanote Apr 13 at 23:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.