Skip to content

Python module to manipulate NTFS Alternate Data Stream (ADS) in Python

Notifications You must be signed in to change notification settings

RobinDavid/pyADS

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

19 Commits
 
 
 
 

Repository files navigation

pyADS

Python module to manipulate NTFS Alternate Data Stream (ADS) of files and directories in Python.

How it works?

On Windows Vista, Windows Server 2003 and later, NTFS Alternate Data Streams can be accessed using the FindFirstStreamW and FindNextStreamW functions. So this module is a direct interface to this function using ctypes and the kernel32 function. The functionalities are:

  • List Alternate streams
  • Add a stream to a file
  • Remove a stream from a file
  • Extract a stream from a file

Methods

All methods are grouped in an ADS class that allow doing multiple operations on the given file. Available methods are:

  • iter standard python way to iterate over all stream names
  • has_streams return True if the file have alternate Streams
  • add_stream_from_file add a file as stream to the file
  • delete_stream remove the given stream of the file
  • get_stream_content return the content of the given stream

Basic example

>>> from pyads import ADS
>>> file = "myfile.txt"

>>> handler = ADS(file)
>>> if handler.has_streams():
...     for stream in handler:
...         print(stream)
...
helloworld.txt
secondfile.jpg


>>> handler.add_stream_from_file("attached.txt")
True
>>> list(handler)
[u'helloworld.txt', u'secondfile.jpg', 'attached.txt']
>>> print(handler.get_stream_content("attached.txt"))
This is the content of an attached file.

License

This software is MIT-Licensed

Credits

Thanks for @Alexey-T and @wesdawg for their improvments

About

Python module to manipulate NTFS Alternate Data Stream (ADS) in Python

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Contributors 3

  •  
  •  
  •  

Languages