NTFS Stream Explorer

NTFS Stream Explorer is a program for working with alternative NTFS file streams and other system streams, including those with extended attributes. Program functions. The program can create, delete, rename NTFS file streams (alternate data streams). Import of stream content from a file and export of a stream to an external file is supported. You can start an NTFS stream as a process.

You can create, delete, and rename extended attributes (EA) for files on NTFS and FAT16 partitions. When you create an attribute, you can set its property flag. The program displays NTFS system threads in its list. You can export their contents to an external file. For system threads of type $OBJECT_ID you can view their internal structure (4 GUIDs). It is also possible to delete an object identifier. The extended part of the identifier can be overwritten with its own data.

For system threads of type $REPARSE_DATA (replay points), viewing their internal structure is also supported. You can see information about the symbolic link, symbolic link, or mount point. For rework points of other types, you can view their GUIDs and export binary information to a file. It is also possible to delete reparse information attached to a file. You can create your own type of reparse point. With the built-in thread scanner you can detect threads present in the system and delete them all at once. Or you can open the file containing the found NTFS threads to investigate them further.