Actually, deleting the host file deletes all associated data streams. If a file of the same name is created on the system, the ADS' will not remain:
\> echo this is a test > notepad.txt \> echo testing again > notepad.txt:ads \> more < notepad.txt this is a test \> more < notepad.txt:ads testing again \> del notepad.txt \> more < notepad.txt:ads The system cannot find the file specified. \> touch notepad.txt \> more < notepad.txt:ads The system cannot find the file specified.
Just my two cents; carry on.
I seem to recall an ADS being handled slightly differently and as a result was more prone to remain even after a delete of the host file, it was a matter of locating it.
my thoughts were more along the lines of
can the original file, even partially overwritten, be recovered with the ADS intact?
will clobbering the original file leave the ADS intact.
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
