kirkpatrickprice / PIIDigger

Program to identify Personally Identifiable Information in common file types
Apache License 2.0
2 stars 0 forks source link

Handle Alternate Data Streams on NTFS Volumes #14

Open flyguy62n opened 5 months ago

flyguy62n commented 5 months ago

Problem

NTFS ADS can be used to write additional content into a separate stream where the file name is of the form 'file name:stream'.

User Story

As a PIIDigger user, data written to an alternate data stream should be evaluated.

Requirements

Inputs

For each file on an NTFS volume, enumerate any ADS.

Outputs

Add the ADS file name 'filename:stream' to the queue of files to be processed by the file handler

Unit Tests

Files with handleable and in-handleable ADS should be added to the 'testdata' folder.

flyguy62n commented 5 months ago

https://github.com/RobinDavid/pyADS