Command Line Parameters
adslist /s /q <DIRECTORY>
DIRECTORY |
The directory to analyze, uses the current directory if none is specified |
/s |
Include sub directories |
/q |
Quiet output, omit headers, omit error messages and only prints text when alternate data streams are found |
/p <filter> |
Exclude paths that match <filter>, wildcards are supported |
|
You can schedule adslist.exe using the EventSentry Application Scheduler, which can analyze the return code and output of the utility and only log an event to the event log when one or more alternate data streams have been found. |
Examples
Example 1: Look for alternate data streams in the %SYSTEMROOT% directory, including sub directories
adslist %SYSTEMROOT% /s
Example 2: Look for the alternate data streams in the C:\Windows\System32, including sub directories, and use the quiet output
adslist C:\Windows\System32 /s /q
Example 3: Look for the alternate data streams on the entire C drive but exclude any path that contains SYSVOL_DFSR\domain\DfsrPrivate\Staging
adslist C:\Windows\System32 /s /p *SYSVOL_DFSR\domain\DfsrPrivate\Staging*
Sample Output
C:\>adslist C:\ /s
0001: C:\\Documents and Settings\Administrator\Favorites\Download details Feature Pack for SQL Server 2005 Nov 2005.url
favicon
0002: C:\\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\68B6GYDG\LSSetup_en_US[1].exe
Zone.Identifier
0003: C:\\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\CUQF6SXR\launch[1].lsf
Zone.Identifier
0004: C:\Images\temp\logo_v2_white.png
?Q30lsldxJoudresxAaaqpcawXc
{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
0005: C:\Images\logo_v2_white.jpg
?Q30lsldxJoudresxAaaqpcawXc
{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Summary:
========
Time elapsed: 5 second(s)
Files Processed: 66680
Files with alternate data streams: 5
Alternate Data Streams found: 7