Come posso identificare / scoprire i file nascosti con ADS?

dir /R li mostra in un ambiente a riga di comando.

Microsoft Windows [Versione 6.1.7600] Copyright (c) 2009 Microsoft Corporation. Tutti i diritti riservati.

C:\Windows\system32>dir /?
Displays a list of files and subdirectories in a directory.

DIR [drive:][path][filename] [/A[[:]attributes]] [/B] [/C] [/D] [/L] [/N]
  [/O[[:]sortorder]] [/P] [/Q] [/R] [/S] [/T[[:]timefield]] [/W] [/X] [/4]

  [drive:][path][filename]
              Specifies drive, directory, and/or files to list.

  /A          Displays files with specified attributes.
  attributes   D  Directories                R  Read-only files
               H  Hidden files               A  Files ready for archiving
               S  System files               I  Not content indexed files
               L  Reparse Points             -  Prefix meaning not
  /B          Uses bare format (no heading information or summary).
  /C          Display the thousand separator in file sizes.  This is the
              default.  Use /-C to disable display of separator.
  /D          Same as wide but files are list sorted by column.
  /L          Uses lowercase.
  /N          New long list format where filenames are on the far right.
  /O          List by files in sorted order.
  sortorder    N  By name (alphabetic)       S  By size (smallest first)
               E  By extension (alphabetic)  D  By date/time (oldest first)
               G  Group directories first    -  Prefix to reverse order
  /P          Pauses after each screenful of information.
  /Q          Display the owner of the file.

  /R          Display alternate data streams of the file.

  /S          Displays files in specified directory and all subdirectories.
  /T          Controls which time field displayed or used for sorting
  timefield   C  Creation
              A  Last Access
              W  Last Written
  /W          Uses wide list format.
  /X          This displays the short names generated for non-8dot3 file
              names.  The format is that of /N with the short name inserted
              before the long name. If no short name is present, blanks are
              displayed in its place.
  /4          Displays four-digit years

Switches may be preset in the DIRCMD environment variable.  Override
preset switches by prefixing any switch with - (hyphen)--for example, /-W.

Oltre a utilizzare lo switch "dir / R" in CMD, ecco un elenco abbastanza completo di strumenti di gestione e scansione di Data Stream alternativo (ADS). Mentre il comando DIR elenca solo i file ADS nella presente directory, gli strumenti sottostanti ti danno la possibilità di scansionare intere unità e visualizzarle facilmente.

ADSManager

Flussi FlexHex

Controlla anche questo link per ulteriori informazioni e risorse di ADS

LADS - List Alternate Data Streams by Frank Heyne

Streams.exe from SysInternals:

ScanADS command line tool:

ADS Spy GUI Scanner:

Crucial ADS GUI Scanner:

ADS Detector for Explorer:

Windows ports of Unix tools like CAT: http://unxutils.sourceforge.net/