Streams Script

Description: A PowerShell script designed to check for Alternate Data Streams (ADS), including the common Zone.Identifier stream, for files within a specified path.

Features:

• Starts checking from the current directory where the script is run.

• Prompts the user whether to search recursively into subdirectories.

• Allows specifying the depth of recursion (number of levels) or searching all subdirectories ('all').

• Displays a progress bar during the scan.

• For each file/directory, it collects:

  • Full Path and Name.

  • MD5 Hash (for files only).

  • Owner (Name/SID).

  • Length (Size).

  • Last Access Time and Last Write Time.

  • File Attributes (Mode).

  • Contents of up to 5 data streams found (Stream1 to Stream5).

  • Contents of up to 4 lines from the Zone.Identifier stream (ZoneId1 to ZoneId4).

• Outputs the collected information into an interactive GridView window.

Usage Hint: Primarily used for identifying files that have Alternate Data Streams, which can sometimes be used to hide data or track file origins (like downloads from the internet via Zone.Identifier).