Isilon: OneFS: How to identify the alternate data stream of a file and view its contents

Summary: This article explains how to identify and view the contents of an Alternate Data Stream (ADS). Support for alternate data streams is in NTFS to support the Mac Hierarchical File System (HFS). The Mac HFS uses resource forks for icons and other file information. While this is the intended use of alternate data streams, malware often uses alternate data streams to hide its code. For this reason, alternate data streams are a concern of system administrators and security professionals. ...

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Instructions

Procedure

 

To identify and view the contents of an alternate data stream, use the streams.exe file provided by Microsoft, or use the isi_runat command in OneFS.


Use streams.exe to look for alternate data streams (Windows)

The streams.exe file and the instructions for its use are available from the Microsoft TechNet website.
 

Use isi_runat to look for alternate data streams (OneFS)


Run the isi_runat command to determine if a file has an alternate data stream:

  1. Open an SSH connection on any node in the cluster and log in using the "root" account.
  2. Run the following command, where <FILENAME> is the name of the file to inspect:
      
    isi_runat <FILENAME> ls

    Output is displayed if the file has an alternate data stream; this output can vary. If the file does not have an alternate data stream, the output is blank.

     
  3. To view the contents of the alternate data stream, run the following command, where <ALT STREAM> is the output from step 2. This output can vary.
      
    isi_runat <FILENAME> cat <ALT STREAM>

    For example, if the file is called sample.txt, and the alternate data source from step 2 is secret.txt, run the following command:
      
    isi_runat sample.txt cat secret.txt

    The output for the alternate data stream is displayed. For example, the content of the alternate data stream secret.txt might be

    This is the secret text



Compare and validate alternate data streams for migrated files.


Perform the procedures above to compare the alternate data streams of source and migrated files. When migrating files to an Isilon cluster from another NAS server (example, a NetApp filer) this error may occur if files have differing alternate data streams. 

The file name that you specified is not valid or too long. Specify a different file name.


To compare the alternate data streams for files:

  1. From the source NAS server, use the streams.exe file to view the alternate data stream of the source file.
  2. Then, from the Isilon cluster, use the isi_runat command to view the alternate data stream of the migrated file.

The output for the alternate data streams should match.


 

Affected Products

Isilon

Products

Isilon
Article Properties
Article Number: 000022971
Article Type: How To
Last Modified: 04 Jul 2025
Version:  4
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.