Getting the alternate data streams (ADS) for a file or folder

This post is one of a series providing implementation examples of Windows API Functions, Types, Enums and Consts using VBA. The code in this post can be used as-is, however, if you regularly (or even just occasionally) work with Windows API declarations in VBA, you may want to see the posts Automatically add Windows API declaration(s) and Using 'F1' to view Windows API web pages which explain some of the functionality that can be added to the VBE by VBE_Extras.

As well as relating to the Windows API, this post is the first of three relating to alternate data streams (ADS).

What is an alternate data stream (I'm going to abbreviate to just "streams" in the rest of this post)? The Microsoft description from the File streams (local file systems) page is "a sequence of bytes. In the NTFS file system, streams contain the data that is written to a file, and that gives more information about a file than attributes and properties. For example, you can create a stream that contains search keywords, or the identity of the user account that creates a file".

So a stream (other than the default stream ... see below) is, kind of, some hidden data associated with a file or folder. And the point of this series of posts is to make those streams far less hidden. A little more info:

A file ...

• Always has at least one stream ... that is the default stream that contains the file data. It is synonymous with the file itself.

• Can have zero or more additional streams.

A folder ...

• Has no stream associated with it by default.

• Can have zero or more additional streams.

A stream has a name and some data (reading/writing the stream data along with deleting streams will be covered in the second and third stream posts). The name of a stream can be any text that would also be legal for a file name, but stream names are always prefixed with ":" and always suffixed with ":$DATA" (it is this ":$DATA" part that identifies the stream as being an alternate data stream as opposed to some other type of stream ... see the File streams (local file systems) page for more details). Also, it is important to know that the default stream has no name meaning that is referred to as "::$DATA" (whereas a stream named, for example, "MyStream" would be referred to as ":MyStream:$DATA").

A last point to note before going further is that streams are a component of the NTFS file system ... they only exist on device that use NTFS, they do not exist on, for example, FAT devices.

So, how to see whether a file or folder has any streams? The answer, of course, is to use the Windows API, specifically the FindFirstStream and FindNextStream Functions which allow code to enumerate the streams associated with a file. Also required is the FindClose Function as the FindFirstStream Function returns a handle which must be closed, the GetVolumeInformation Function which allows code to test whether a file or folder is on an NTFS file system or not and a couple of other helper Functions. There is also various Consts, Enums and Types to support the Functions. To explore each of these further, I suggest you download VBE_Extras and use the Using 'F1' to view Windows API web pages functionality to explore the Microsoft help pages for each of these.

Here's the code. Each VBA procedure is documented so that you can understand what it is doing. Copy and paste this code into a standard Module ... I name it "UtilsStreams".

And here is an example of how you might use the above code ... copy this code and put it in another standard Module.

You can try running this with the value for sPATH_TO_FILE_OR_FOLDER as-is but the "fun" comes with testing the streams you might find for other files. So try changing sPATH_TO_FILE_OR_FOLDER to point to other files or folders and see what results you get. Note that the majority of files only have the default stream and the majority of folders have no streams.

A good place to test to try and find files with additional streams is the Downloads folder on your device. The reason will become clear in the subsequent posts.