OVALProject/Sandbox — Issue #9: allow for access to alternate data streams associated with windows files
Author: djhaynes
Created: 2012-03-05 14:13:27+00:00
State: open

Access to Alternate Data Streams:
- May require extension of the File Object in OVAL
- Tool vendors have multiple implementation options, but none are perfect
- FindFirstStreamW() / FindNextStreamW() available on 2003 and later (http://msdn.microsoft.com/en-us/library/aa364424(v=vs.85).aspx) also see the WIN32_FIND_STREAM_DATA Structure.
- BackupRead() - performance implications
- NtQueryInformationFile / ZwQueryInformationFile (undocumented/unsupported)

Please see slide 7 of the slides attached to the following oval-developer-list post.

http://making-security-measurable.1364806.n2.nabble.com/Developer-Days-Artifact-Hunting-Slides-tp6463048p6463048.html