Using Streams Program Example
The example in this topic demonstrates how to use basic NTFS file system streams. This example creates a file, called anothertestfile, (without any extension) with a size of 46 bytes. However, the file also has a file stream, called stream, which adds an additional 24 bytes that is not reported by the operating system. Therefore, when you view the file-size property for the file, you see only the size of the file testfile.
Create a new empty Win32 console application project. Give a suitable project name and change the project location if needed.
Then, add the source file and give it a suitable name.
Next, add the following source code.
#include <windows.h>
#include <stdio.h>
#include <strsafe.h>
// A prototype that receives a function name, displaying
// system error code and its respective message
void DisplayErrorBox(LPTSTR lpszFunction);
int wmain(int argc, WCHAR *argv[])
{
HANDLE hFile, hStream;
DWORD dwRet;
hFile = CreateFile(Lanothertestfile,
GENERIC_WRITE,
FILE_SHARE_WRITE,
NULL,
OPEN_ALWAYS,
0,
NULL );
if(hFile == INVALID_HANDLE_VALUE )
{
DisplayErrorBox(LCreateFile());
return 1;
}
else
{
wprintf(LCreateFile() should be fine!\n);
wprintf(LWriting some bytes to anothertestfile...\n);
if(WriteFile(hFile, LThis is anothertestfile, 46, &dwRet, NULL ) != 0)
wprintf(LWriteFile() is fine!\n);
else
DisplayErrorBox(LWriteFile());
}
hStream = CreateFile(Lanothertestfile:stream,
GENERIC_WRITE,
FILE_SHARE_WRITE,
NULL,
OPEN_ALWAYS,
0,
NULL );
if(hStream == INVALID_HANDLE_VALUE)
DisplayErrorBox(LCreateFile());
else
{
wprintf(LCreateFile() should be fine!\n);
wprintf(LWriting some stream to the file...\n);
// Take note the 3rd parameter which must be ample for Unicode/multibyte
if(WriteFile(hStream, LThis is anothertestfile:stream, 60, &dwRet, NULL) != 0)
wprintf(LWriteFile() is fine!\n);
else
DisplayErrorBox(LWriteFile());
}
return 0;
}
void DisplayErrorBox(LPTSTR lpszFunction)
{
// Retrieve the system error message for the last-error code
LPVOID lpMsgBuf;
LPVOID lpDisplayBuf;
DWORD dw = GetLastError();
FormatMessage(
FORMAT_MESSAGE_ALLOCATE_BUFFER |
FORMAT_MESSAGE_FROM_SYSTEM |
FORMAT_MESSAGE_IGNORE_INSERTS,
NULL,
dw,
MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
(LPTSTR) &lpMsgBuf,
0, NULL);
// Display the error message and clean up
lpDisplayBuf = (LPVOID)LocalAlloc(LMEM_ZEROINIT, (lstrlen((LPCTSTR)lpMsgBuf)+lstrlen((LPCTSTR)lpszFunction)+40)*sizeof(WCHAR));
StringCchPrintf((LPTSTR)lpDisplayBuf, LocalSize(lpDisplayBuf) / sizeof(WCHAR), L%s failed with error %d: %s, lpszFunction, dw, lpMsgBuf);
MessageBox(NULL, (LPCTSTR)lpDisplayBuf, LError, MB_OK);
LocalFree(lpMsgBuf);
LocalFree(lpDisplayBuf);
}
If you type type anothertestfile at a command prompt, it displays the following output:
T h i s i s a n o t h e r t e s t f i l e
However, if you type the words type testfile:stream, it generates the following error:
The filename, directory name, or volume label syntax is incorrect.

To view what is in testfile:stream, use WordPad by entering the following command:
C:\Program Files\Windows NT\Accessories\wordpad.exe anothertestfile:stream

The text displayed in WordPad is as follows.

Or you can use the more command.

To edit the file content, we can use the echo command. For example:
echo This is another new string for anothertestfile:stream > anothertestfile:stream

The following is the sample output for the edited file stream when verified using more command.

Alternate File Stream
From user point of view, tools and story for NTFS Alternate File Stream, please refer to the following link: NTFS Alternate File Stream – What, When and How-to (http://www.flexhex.com/docs/articles/alternate-streams.phtml).