Detecting Stealth ADS with The Sleuth Kit (TSK)

Exploit Monday has an interesting article on Stealth Alternate Data Streams and Other ADS Weirdness - read it if you haven't already. The author points out some ways to disrupt traditional stream detection tools. Since I created my own stream detection tool (see Chapter 10 of Malware Analyst's Cookbook), I was interested to see how it would fare. The tool is built on The Sleuth Kit API, thus it reads directly from the MFT instead of relying on Windows API functions.

Here is a basic listing of my C: drive contents:

C:\>dir
Volume in drive C has no label.
Volume Serial Number is 400B-1E43

Directory of C:\

08/22/2010  01:36 PM                 0 AUTOEXEC.BAT
08/22/2010  01:36 PM                 0 CONFIG.SYS
08/22/2010  01:38 PM    dir          Documents and Settings
06/03/2011  02:58 PM    dir          Program Files
09/20/2011  10:50 AM    dir          WINDOWS

Now I'll create a few of the special streams.

C:\>echo hi > \\?\C:\NUL
C:\>echo hi > \\?\C:\NUL:hidden

C:\>echo hi > test.txt
C:\>echo hi > test.txt:^G^G^G

Sanity check on the drive contents (we should see two new files):

C:\>dir
Volume in drive C has no label.
Volume Serial Number is 400B-1E43

Directory of C:\

08/22/2010  01:36 PM                 0 AUTOEXEC.BAT
08/22/2010  01:36 PM                 0 CONFIG.SYS
08/22/2010  01:38 PM    dir          Documents and Settings
09/20/2011  10:57 AM                 5 NUL
06/03/2011  02:58 PM    dir          Program Files
09/20/2011  11:21 AM                 5 test.txt
09/20/2011  10:50 AM    dir          WINDOWS

Now let's see how we do! I'll use tsk-xview.exe (note you also need offreg.dll).

Z:\tools>tsk-xview.exe -r -v

[INFO] High-level enumeration. Please wait.
[INFO] Found 95773 files and dirs
[INFO] Opened \\.\PhysicalDrive0
[INFO] Partition NTFS (0x07) at sector 56
[INFO] Low-level enumeration. Please wait.
[STREAM] C:/NUL:hidden
Inode: 12991-128-3
Size: 8
SIA Created:         Tue Sep 20 10:56:14 2011
SIA File Modified:   Tue Sep 20 10:57:27 2011
SIA MFT Modified:    Tue Sep 20 10:57:27 2011
SIA Accessed:        Tue Sep 20 10:57:27 2011
FNI Created:         Tue Sep 20 10:56:14 2011
FNI File Modified:   Tue Sep 20 10:56:14 2011
FNI MFT Modified:    Tue Sep 20 10:56:14 2011
FNI Accessed:        Tue Sep 20 10:56:14 2011
[STREAM] C:/test.txt:^^^
Inode: 12994-128-6
Size: 5
SIA Created:         Tue Sep 20 10:58:25 2011
SIA File Modified:   Tue Sep 20 11:21:17 2011
SIA MFT Modified:    Tue Sep 20 11:21:17 2011
SIA Accessed:        Tue Sep 20 11:21:17 2011
FNI Created:         Tue Sep 20 10:58:25 2011
FNI File Modified:   Tue Sep 20 10:58:25 2011
FNI MFT Modified:    Tue Sep 20 10:58:25 2011
FNI Accessed:        Tue Sep 20 10:58:25 2011

It detected both streams perfectly, albeit displaying the file name as ^^^ instead of ^G^G^G (it could be more console-friendly and print those chars as hex values).