This is an old revision of this page, as edited by 213.100.51.206 (talk) at 14:50, 8 November 2005 (→External links). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.
Revision as of 14:50, 8 November 2005 by 213.100.51.206 (talk) (→External links)(diff) ← Previous revision | Latest revision (diff) | Newer revision → (diff)In computing, a fork is additional data associated with a file system object. Filesystem forks are traditionally associated with Apple's Hierarchical File System (HFS), however they are also available in Microsoft's NTFS filesystem, where they are known as alternate data streams. Other filesystems such as Novell's Novell Storage Services (NSS) and Netware File System (NWFS), and Veritas Software's Veritas File System (VxFS) also support filesystem forks, some pre-dating Microsoft's implementation.
HFS was designed to use resource forks to store metadata about a file that would be used by the graphical user interface (GUI) of the Apple Macintosh, such as a file icon or an image preview. However the feature was not limited to GUI data, so additional uses were found, such as splitting a word processing document into content and presentation, then storing the presentation information in the resource fork.
Starting in 1985, NWFS and its successor NSS were designed from the ground up to use a variety of methods to store a file's metadata. Some metadata resides in Novell Directory Services (NDS), some is stored in the directory structure on the disk, and some is stored in, as Novell terms it, 'multiple data streams' with the file itself. Multiple data streams also allow Macintosh clients to attach to and use Netware servers.
Support for filesystem forks (aka alternate data streams) were added to NTFS so that servers running Windows NT could host files for Macintosh users. With Windows 2000, Microsoft started using alternate data streams in NTFS to store things like "author" or "title" file attributes or document thumbnail images. Due to their relative obscurity and the fact that they are typically hidden from the user's view, alternate data streams have attracted attention from computer virus writers, who try to attach viruses to crucial system files. Another problem is that the file manipulation tools that come with Windows cannot actually remove alternate data streams from a file, they can only remove the entire file or alter the content of an alternate data stream. However there are now a number of third-party tools that can remove alternate data streams.
External links
- Apple Glossary
- Multi-Fork File System
- How To Use NTFS Alternate Data Streams from Microsoft.com
- Windows NTFS Alternate Data Streams by Don Parker writing for SecurityFocus.com
- Hidden Threat: Alternate Data Streams by Ray Zadjmool writing for WindowsSecurity.com
- LADS List Alternate Data Streams - a tool to search for NTFS alternate data streams
- LNS List NTFS Streams - a tool to search for NTFS alternate data streams
- ScanADS Scan Alternate Data Streams - an open source tool to scan NTFS alternate data streams
- fsattr - extended file attributes in Solaris UFS