Process NTFS Alternate Data Streams

Applies to: Pro, Enterprise and Audit

What alternate data streams are

On NTFS, a file can contain named data streams in addition to the normal unnamed stream shown by most applications. These streams can hold metadata or other content without appearing as separate files in ordinary directory listings.

CertErase behavior

When Scrub Alternate Data Streams is enabled, CertErase attempts to:

  1. Enumerate accessible named streams associated with the target file;
  2. Open each stream;
  3. Overwrite its accessible logical content with random data;
  4. Request deletion of the stream;
  5. Continue with the normal file data and deletion process.

The normal unnamed stream is overwritten according to the selected erasure method. Alternate streams use the application’s dedicated stream-processing routine rather than the full selected multi-pass profile.

Enable the control

  1. In the File Content Security area of settings, enable Scrub Alternate Data Streams.
  2. Confirm that the target resides on NTFS or another environment where named streams are meaningful.
  3. Run a representative test.
  4. Review the output for stream enumeration or access failures.

Limitations

A successful operation covers streams that the Windows APIs expose and that the operator can access. It does not prove removal of:

  • File-system journals;
  • Search indexes;
  • Shadow copies;
  • Backup catalogues;
  • Antivirus or endpoint telemetry;
  • Synchronized or remote copies;
  • Storage-controller remnants.

On a file system without NTFS-style named streams, enabling this control may add no meaningful coverage.

Recommended use

Enable this control for NTFS targets where the data source or threat model permits content in named streams. Keep it enabled in approved enterprise baselines unless testing shows a compatibility issue that is understood and accepted.