Click here to Skip to main content
14,037,996 members
Click here to Skip to main content
Add your own
alternative version


130 bookmarked
Posted 31 Jul 2002
Licenced CPOL

Accessing alternative data-streams of files on an NTFS volume

, 15 Aug 2016
Rate this:
Please Sign up or sign in to vote.
A pair of classes to encapsulate access to NTFS alternative data streams.


Since NT 3.1, the NTFS file system has supported multiple data-streams for files. There has never been built-in support for viewing or manipulating these additional streams, but the Windows API functions include support for them with a special file syntax: Filename.ext:StreamName. Even Win9x machines can access the alternative data streams of files on any NTFS volume they have access to, e.g., through a mapped drive. Because the Scripting.FileSystemObject and many other libraries call the CreateFile API behind the scenes, even scripts have been able to access alternative streams quite easily (although enumerating the existing streams has always been tricky).

In .NET, however, it seems someone decided to add some checking to the format of filenames. If you attempt to open a FileStream on an alternative stream, you will get a "Path Format not supported" exception. I have been unable to find any class in the CLR that provides support for alternative data streams, so I decided to roll my own.


I originally wrote this code in 2002, targeting v1 of the .NET Framework. Looking at the code now, it seems quite messy, and has several bugs and problems which were mentioned in the comments. I have since completely re-written the code for .NET v3.5, and (hopefully) fixed the bugs.

The new code is not compatible with the original version. However, I have included a sample compatibility wrapper which maps the old API to the new API. You can find these files under the "other/Compatibility wrapper" folder in the download.

Bugs / Issues Fixed

  • The code now uses the FileSystemInfo class rather than the FileInfo class. This allows you to access alternate data streams attached to folders as well as files. (Suggested by Dan Elebash.)
  • The code now uses SafeFileHandle instead of IntPtr for the file handle. (Suggested by Moomansun.)
  • The code is now 64-bit compatible. (Reported by John SMith 5634552745.)
  • The code now correctly calls BackupRead with the bAbort parameter set to true after enumerating the streams. (Reported by scooter_jsm.)
  • The number of global memory allocations required to read the streams from a file has been reduced. (Suggested by scooter_jsm.)
  • v2.1: ValidateStreamName now accepts stream names which contain characters with ASCII codes between 1 and 31. (Reported by Andy Missico.)
  • v2.1: The code will now attempt to map standard IO errors to the equivalent .NET Exception type. (Suggested by Andy Missico.)

Using the Classes

The AlternateDataStreamInfo class represents the details of an individual stream, and provides methods to create, open, or delete the stream.

The static FileSystem class provides methods to retrieve the list of streams for a file, retrieve a specific stream from a file, determine whether a stream exists, and delete a specific stream.

All methods on the FileSystem class offer overloads which accept either a path or a FileSystemInfo object. The overloads which accept a FileSystemInfo object can also be invoked as extension methods.


using System;
using System.Drawing;
using System.Drawing.Imaging;
using System.IO;
using Trinet.Core.IO.Ntfs;


FileInfo file = new FileInfo(path);

// List the additional streams for a file:
foreach (AlternateDataStreamInfo s in file.ListAlternateDataStreams())
    Console.WriteLine("{0} - {1} bytes", s.Name, s.Size);

// Read the "Zone.Identifier" stream, if it exists:
if (file.AlternateDataStreamExists("Zone.Identifier"))
    Console.WriteLine("Found zone identifier stream:");
    AlternateDataStreamInfo s = 
    using (TextReader reader = s.OpenText())
    // Delete the stream:
    Console.WriteLine("No zone identifier stream found.");

// Alternative method to delete the stream:

Files Included

  • The Trinet.Core.IO.Ntfs folder contains the source code.
  • The doc folder contains the documentation and FxCop project.
  • The bin folder contains the compiled assembly.
  • The other folder contains the compatibility wrapper, and a sample to recursively delete the "Zone.Identifier" stream from all files in a given path.


If you want more information on NTFS programming, or the C++ code I based this on, see Dino Esposito's MSDN article from March 2000: [^].


  • v1 - 1 August 2002 - Initial release, targeting .NET 1.0.
  • v2 - 16 September 2008 - Re-written to target .NET 3.5; major changes include:
    • Replaced FileInfo with FileSystemInfo.
    • Replaced IntPtr with SafeFileHandle.
    • Made the P/Invoke calls 64-bit compatible.
    • Made the code abort the BackupRead operation after enumerating the streams.
    • Reduced the number of global memory allocations required.
  • v2.1 - 28 July 2010 - Minor fixes suggested by Andy Missico:
    • Changed ValidateStreamName to accept stream names containing characters with ASCII codes between 1 and 31 (see
    • Added mapping of standard IO errors to the correct .NET exceptions.
  • v2.2 - 15 August 2016 - Fix for bug reported by Member 12683101, where zero-length alternate streams prevented subsequent streams from being enumerated.


This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


About the Author

Richard Deeming
Software Developer Nevalee Business Solutions
United Kingdom United Kingdom
No Biography provided

You may also be interested in...

Comments and Discussions

Questionerror Pin
Prince iraq16-Mar-12 0:11
memberPrince iraq16-Mar-12 0:11 
AnswerRe: error Pin
Richard Deeming16-Mar-12 3:04
mveRichard Deeming16-Mar-12 3:04 
GeneralRe: error Pin
Prince iraq16-Mar-12 7:40
memberPrince iraq16-Mar-12 7:40 
QuestionHow to close the stream? Pin
DOSSTONED22-Feb-11 4:26
memberDOSSTONED22-Feb-11 4:26 
AnswerRe: How to close the stream? Pin
Richard Deeming22-Feb-11 6:15
mveRichard Deeming22-Feb-11 6:15 
GeneralRe: How to close the stream? Pin
DOSSTONED22-Feb-11 16:35
memberDOSSTONED22-Feb-11 16:35 
GeneralConvenience methods Pin
VenDiddy6-Aug-10 8:22
memberVenDiddy6-Aug-10 8:22 
GeneralExample code still not running properly on mapped network drive [modified] Pin
LastZolex14-Jun-10 11:29
memberLastZolex14-Jun-10 11:29 
Hi there.

Maybe I don't get it right, but I can't get the console app "TestNTFS" from your folder "\other\Compatibility wrapper" running properly.

I always get the exception (it's a german one)

System.ComponentModel.Win32Exception was unhandled
  Message=Die Syntax für den Dateinamen, Verzeichnisnamen oder die Datenträgerbezeichnung ist falsch
       at Trinet.Core.IO.Ntfs.SafeNativeMethods.ThrowLastWin32Error() in N:\CSharp\MemoryClones\MeMoMeSharply\trunk\Trinet.Core.IO.Ntfs\SafeNativeMethods.cs:line 182
       at Trinet.Core.IO.Ntfs.SafeNativeMethods.SafeGetFileAttributes(String name) in N:\CSharp\MemoryClones\MeMoMeSharply\trunk\Trinet.Core.IO.Ntfs\SafeNativeMethods.cs:line 222
       at Trinet.Core.IO.Ntfs.FileSystem.GetAlternateDataStream(FileSystemInfo file, String streamName, FileMode mode) in N:\CSharp\MemoryClones\MeMoMeSharply\trunk\Trinet.Core.IO.Ntfs\FileSystem.cs:line 231
       at NTFS.FileStreams.Add(String streamName) in N:\CSharp\MemoryClones\MeMoMeSharply\trunk\Trinet.Core.IO.Ntfs.Tests\FileStreams.cs:line 138
       at NTFS.Test.TestNTFS.TestStream() in N:\CSharp\MemoryClones\MeMoMeSharply\trunk\Trinet.Core.IO.Ntfs.Tests\TestNTFS.cs:line 52
       at NTFS.Test.TestNTFS.Main(String[] args) in N:\CSharp\MemoryClones\MeMoMeSharply\trunk\Trinet.Core.IO.Ntfs.Tests\TestNTFS.cs:line 17
       at System.AppDomain._nExecuteAssembly(RuntimeAssembly assembly, String[] args)
       at System.AppDomain.ExecuteAssembly(String assemblyFile, Evidence assemblySecurity, String[] args)
       at Microsoft.VisualStudio.HostingProcess.HostProc.RunUsersAssembly()
       at System.Threading.ThreadHelper.ThreadStart_Context(Object state)
       at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean ignoreSyncCtx)
       at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
       at System.Threading.ThreadHelper.ThreadStart()

The above exception says: "The filename, directory name, or volume label syntax is incorrect", and I have no idea why this is so.
The testsystem is XP32 SP2 with Visual Studio 2010 (and because of VC2010 it is of course .NET 4.0).

As it was mentioned some postings below I have to admit there is something special about the drive "N:" I use. It is a mapped network drive and the VS2010 is running in an virtualized environment (VMWare).

The mapped network drive IS causing my troubles! I tried the demo app in a path "C:\\tmp" and it worked.
Some postings below there was someone with a similar problem, but as the comment says "mapped network drives are working properly" I hoped it would work out. But it does not.

Does anybody know a clean solution for this problem, if the app does not know that the drive is a mapped network drive?

Any help is appreciated!

Thanks in advance!



Ok, I annoy you now with my progress in solving the problem. It is unsolved yet Wink | ;-)

As a first try I added a "networkdrive to UNC path" method which i borrowed here: GetUNCPath-Method

This transforms my original mapped network path from



"\\\\vmware-host\\Shared Folders\\Projekte\\CSharp\\MemoryClones\\MeMoMeSharply\\trunk\\Trinet.Core.IO.Ntfs.Tests\\bin\\Debug\\test.jpg:thumb:$DATA"

But this changed nothing. It still works on the local HDD path but not on the remote network path.

So I still need help from you, if possible Wink | ;-)

modified on Tuesday, June 15, 2010 2:43 AM

GeneralRe: Example code still not running properly on mapped network drive Pin
Richard Deeming15-Jun-10 1:38
mveRichard Deeming15-Jun-10 1:38 
GeneralRe: Example code still not running properly on mapped network drive [modified] Pin
LastZolex15-Jun-10 2:09
memberLastZolex15-Jun-10 2:09 
GeneralRe: Example code still not running properly on mapped network drive [modified] Pin
Ashutosh Bhawasinka12-Mar-12 16:51
memberAshutosh Bhawasinka12-Mar-12 16:51 
GeneralThis article is a great help! Pin
LastZolex11-Jun-10 23:44
memberLastZolex11-Jun-10 23:44 
GeneralNeed to Map Win32Exception to Appropriate .NET Exception Pin
Andy Missico30-Mar-10 13:07
memberAndy Missico30-Mar-10 13:07 
GeneralRe: Need to Map Win32Exception to Appropriate .NET Exception Pin
Richard Deeming27-Jul-10 7:23
mveRichard Deeming27-Jul-10 7:23 
GeneralValidateStreamName Incorrect Uses GetInvalidFileNameChars Pin
Andy Missico30-Mar-10 12:36
memberAndy Missico30-Mar-10 12:36 
GeneralProblem accessing alternate data stream of a network shared drive Pin
m.vinod859-Nov-09 10:40
memberm.vinod859-Nov-09 10:40 
GeneralRe: Problem accessing alternate data stream of a network shared drive Pin
Richard Deeming10-Nov-09 2:02
mveRichard Deeming10-Nov-09 2:02 
GeneralRe: Problem accessing alternate data stream of a network shared drive Pin
m.vinod8510-Nov-09 5:44
memberm.vinod8510-Nov-09 5:44 
GeneralRe: Problem accessing alternate data stream of a network shared drive Pin
Richard Deeming10-Nov-09 6:54
mveRichard Deeming10-Nov-09 6:54 
Questionhow to compile these sourecs Pin
hefeilixin29-Sep-09 17:36
memberhefeilixin29-Sep-09 17:36 
AnswerRe: how to compile these sourecs Pin
Richard Deeming30-Sep-09 1:31
mveRichard Deeming30-Sep-09 1:31 
Newsanother question Pin
hefeilixin9-Oct-09 21:44
memberhefeilixin9-Oct-09 21:44 
GeneralRe: another question Pin
Richard Deeming12-Oct-09 1:08
mveRichard Deeming12-Oct-09 1:08 
GeneralRe: another question Pin
#realJSOP11-Feb-11 1:51
mve#realJSOP11-Feb-11 1:51 
GeneralFileInfo question Pin
Brendan Chong16-Sep-09 7:33
memberBrendan Chong16-Sep-09 7:33 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

Permalink | Advertise | Privacy | Cookies | Terms of Use | Mobile
Web03 | 2.8.190425.1 | Last Updated 15 Aug 2016
Article Copyright 2002 by Richard Deeming
Everything else Copyright © CodeProject, 1999-2019
Layout: fixed | fluid