Member Avatar for Easter Bunny

when i copied mp3's to my dad's harddrive (connected on my pc) i got this window popping up (this was quite some time ago). then about 5minutes ago i copied "format.exe" to a stiffy for a machine i want to install "virus98" on (i've got an old game that doesn't work on XP or 2000). when i clicked "paste" this sodding message popped up again. is there something i'm missing here?

65465498.JPG 19.7 KB
  • 5 Contributors
  • 9 Replies
  • 389 Views
  • 1 Year Discussion Span
  • Latest Post Latest Post by DMR

Dani AI

Generated

Short summary and practical context: the dialog you saw is the OS warning that a file carried extra NTFS-only metadata called alternate data streams (ADS). Those extra streams are not part of the file’s primary data fork and therefore won’t survive being copied to media or filesystems that don’t support streams (floppies, many USB sticks formatted FAT/exFAT, some network or archive workflows). ’s explanation is correct — Explorer is just warning you that those attached streams will be discarded on the target. (learn.microsoft.com)

Why this matters in practice: one very common ADS is the Zone.Identifier “Mark‑of‑the‑Web” that browsers/Attachment Manager write to downloaded files; it’s what causes “this file came from the Internet” warnings and can change how Explorer/Office treat a file (previewing, Protected View, SmartScreen, etc.). Removing that ADS clears the warning, but it’s removing metadata that Windows uses for safety decisions. (learn.microsoft.com)

Quick, useful commands (run from an elevated prompt or PowerShell where appropriate) — these let you see and remove streams:

# cmd
dir /R <folder-or-file>

# PowerShell (lists streams; read or delete a Zone.Identifier)
Get-Item -Path .\file.ext -Stream *
Get-Content -Path .\file.ext -Stream Zone.Identifier
Remove-Item -Path .\file.ext -Stream Zone.Identifier
Unblock-File -Path .\file.ext

# Sysinternals (download from Microsoft)
streams.exe -s C:\path\to\folder       # recursively list
streams.exe -d suspicious.zip         # delete streams from a file

Tools above are the usual, safe options for inspection and cleanup. (learn.microsoft.com)

How to preserve streams when you need them: copy only to a target that supports NTFS streams (format the destination NTFS, copy into an NTFS-formatted VHD/VHDX, or use a copy tool that preserves ADS when both sides support them — modern Robocopy variants can be configured to include extended attributes/streams). If you truly need a bit-for-bit copy that includes filesystem metadata, image the volume instead of doing a plain file copy. (support.microsoft.com)

Security notes and a practical caution: ADS can be used for harmless metadata (favicon, Zone.Identifier) but can also be abused to hide payloads or persistence artifacts. Before you move or run an executable on another machine (for example, copying that old format.exe to a floppy for an older PC), scan the file with up‑to‑date AV, inspect its streams, and only remove Zone.Identifier if you understand the security trade‑off (removing it removes Windows’ provenance marker). ’s instinct to check system state wasn’t wrong — a quick streams/PowerShell check plus an AV scan is the lightweight path here. (threatspike.com)

Recommended Answers

All 9 Replies

Member Avatar for kylethedarkn

I'm pretty sure that just means that the file had something attached to it thats extra but the computer can't support it. But just in case download and run it. Post the log back here. (don't fix anything yet)

Member Avatar for DMR

The message is perfectly normal- it is indicating that the files in question have metadata stored in Alternate Data Streams (ADS). The NTFS filesystem supports ADS, but they will be lost/stripped when transferred to media formatted with another filesystem (the files themselves will remain intact, however).

Member Avatar for kylethedarkn

Nevermind then with that HJT log.

Member Avatar for DMR

Nevermind then with that HJT log.

Yeah, it's (thankfully) not a malicious thing. :)

Member Avatar for Faunito

There's an obvious contradiction. If the file is stripped of some extra information, then the phrase that states that "the file itself will not be affected" is simply B.S. When I COPY a file from one mediom to another, regardless of the file system (I couldn't care less which one is which), I want it copied complete, up to the last bit of the last byte. If a single bit is wrong in the copy, that is, it difffers from the original, then the file WAS "affected" and the copy is worthless, as it is NOT a copy. Someone has a definitive answer, please?

Member Avatar for DMR

It sounds as though you may be unfamiliar with the relationship between files and the filesystems on which they are created.

In your scenario, although technically it certainly is altered from the original, the copy of the file made under such circumstances is hardly "worthless"; the substantive data in the file (the data with which users and applications are usually concerned) is still intact.

Take, for example, a Word document created on a Windows machine whose hard drive is formatted with the NTFS filesystem. This Word file can obviously be copied via floppy, CD, etc. to a Mac computer using the HFS+ filesystem and opened/edited/saved/printed/etc. in that Mac's version of Word.
From the user's perspective, the file is a perfectly usable copy of the .doc file created on the PC, right?

During such a transfer though, certain filesystem-specific metadata (like NTFS permissions, for example) will get discarded, as the target HFS filesystem has no need (and often no understanding) of that metadata. Just as a point of interest, note that certain Mac-specific metadata will actually get added to the file once it is living on the Mac's HFS drive, as a Mac file is usually comprised of two forks (the Mac equivalent of Alternate Data Streams): a data fork, and a resource fork.

These "translation" issues are just the (mostly) unavoidable effects of transporting/transferring files between disparate filesystems, given that metadata (such as Alternate Data Streams, Forks, Extended Attributes, Permissions, etc). are usually specific to the filesystem under which a file was originally created. If you need a true/fully-intact copy of a file, you will need to maintain filesystem consistency across the media on which the file is transferred.

Member Avatar for gerbil

A nice read, DMR. Thanks.

Member Avatar for Faunito

Gee, DMR, thank you for your VERY educated answer, and for shedding light on the subject. Now I fully grasp what that messsage and these comments were talking about. Thanks again!

Member Avatar for DMR

Glad I could help :)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.