DePhoegon icon

AltDataStreamSniffer

DePhoegon | PRO | 04/02/24 03:45:53 PM UTC (Edited) | 0 ⭐ | 5052 👁️ | Never ⏰ | []
PowerShell |

2.39 KB

|

Cybersecurity

|

0 👍

/

0 👎

# .\file_name.ps1 -excludeZone 1 15 'c'
# 0 for false, 1 for True - Alot of downloaded files have it.
# using '' to pass the drive letter alone 
param (
    [bool]$excludeZone = $false,
    [int]$fbfeq = [int]$args[1],
    [string]$base = [string]$args[2]
)
 
# Specify the drive or directory to search
$drive = $base+":\\"
$outputFile = "D:\\ADS_Report.txt"
$errorFile = "D:\\ADS_Errors.txt"
$counter = 0
 
# Initialize a queue with the base directory
# Manually force to work from the starting point & work backwards, not building the directory list first, saving time.
$queue = New-Object System.Collections.Queue
$queue.Enqueue($drive)
 
while ($queue.Count -gt 0) {
    # Dequeue current directory
    $directory = $queue.Dequeue()
 
    try {
        $items = Get-ChildItem -Path $directory -File -ErrorAction Stop
 
        foreach ($item in $items) {
            $counter++
            if ($counter % $fbfeq -eq 0) { Write-Output ("Processed {0} files..." -f $counter) }
 
            # Check if the item has an alternative data stream
            $streams = Get-Item -Path $item.FullName -Stream * -ErrorAction Stop 
            # Excludes expected & default streams
            $streamsWithoutZoneIdentifier = $streams | Where-Object { $_.Stream -ne ':' -and $_.Stream -ne ':$DATA' } 
            # Excludes Zone.Idenifier, if argument was true.
            if ($excludeZone) { $streamsWithoutZoneIdentifier = $streamsWithoutZoneIdentifier | Where-Object { $_.Stream -ne 'Zone.Identifier' } } 
           
 
            # 0 is used, as the stream count has the ones excluded from the count already removed from this one.
            if ($streamsWithoutZoneIdentifier.Count -gt 0) {
                # Outputs All streams for the file, using the non filtered stream
                $streams | ForEach-Object { Add-Content -Path $outputFile -Value ("{0} - {1}" -f $item.FullName, $_.Stream) }
            }
        }
 
        # Get all subdirectories in the current directory (non-recursively)
        $subdirectories = Get-ChildItem -Path $directory -Directory -ErrorAction Stop
 
        # Enqueue the subdirectories
        foreach ($subdirectory in $subdirectories) { $queue.Enqueue($subdirectory.FullName) }
    }
    catch {
        # Write the error to the error file
        Add-Content -Path $errorFile -Value ("Error processing '{0}': {1}" -f $directory, $_.Exception.Message)
    }
}

Comments

  •  icon
    01/01/70 12:00:00 AM UTC
    Plain Text |

    0 B

    |

    👍

    /

    👎