Is it possible to search for files which are hard links or have multiple data streams ?

[shodan]

multiple data streams are a very obscure feature of NTFS also known as alternate data stream

Basically multiple different files that have the same name.

There is also hardlinks that I am curious to find if there are any on my system ?


https://en.wikipedia.org/wiki/NTFS#Hard_links
https://en.wikipedia.org/wiki/NTFS#Alte ... ream_(ADS)

[void]

Everything 1.5 will be able to show hardlink names and alternate data stream names.



To find files that have multiple hard links, include the following in your search:

hard-link-count:>1



To view the hard link names:

• Right click the result list column header and click Add columns....
• Search for: hard
• Select Hard Link Filenames and click OK.

To find files that have alternative data streams, include the following in your search:

alternate-data-stream-count:



To view the alternate data stream names:

• Right click the result list column header and click Add columns....
• Search for: hard
• Select Alternate Data Stream Names and click OK.

[shodan]

Thanks !!

Very interesting, I found way more of them than I suspected !

I was curious to know what else could be known about these files

I found in the columns Hard link Count and Hard link filenames

2023-07-04 03_11_45-hard-link-count__1 - Everything (1.5a) 1.5.0.1330a (x64).png (490.96 KiB) Viewed 5175 times

Is it possible with an URL like ES:\\hard-link-count:>1

To specify columns to add to the view ?

maybe something like

ES:\\hard-link-count:>1,-add-columns%20 ... 0Filenames"

interesting alternate streams are much less common !

2023-07-04 03_31_49-alternate-data-stream-count__1 - Everything (1.5a) 1.5.0.1330a (x64).png (30.3 KiB) Viewed 5175 times