ADS Locator

ADS Locator is a feather-light and portable software application that automatically scans the computer for files with alternate data streams attached and lets you extract them. It can help you track down malware agents which use this type of technology to infiltrate into your PC.

No installation required

As this is a portable package, you can drop the program files in any part of the disk and just click the executable to launch ADS Locator. There is also the option to save it to a removable storage unit to directly run it on any PC and check it for alternate data streams. Plus, it doesn't change Windows registry settings, unlike most installers.

Scan drives and examine file information

Wrapped in a simplistic interface made from a classical window with a couple of buttons, ADS Locator invites you to pick a directory or drive from a tree view, in order to verify it for ADS.
During the scan procedure, you can check out the currently scanned file in the status bar, along with the file name, ADS name and size, file date, and full path for each object tracked down so far. This task cannot be paused or canceled.

Extract alternate data streams from files

After studying each entry, you can extract any selected stream to any part of the HDD. Unfortunately, the utility doesn't feature batch support, so you can extract only one stream at a time.
Worth mentioning is that ADS Locator does not affect the original file but only makes a copy of the selected ADS and saves it separately, which you can later submit for malware analysis using specialized software.

Evaluation and conclusion

The tool carries out scan jobs pretty fast, depending on the size of the target directory. Unsurprisingly, it used low CPU and RAM during our tests, so it didn't hamper system performance.
On the other hand, it contains only some basic options and no kind of configuration settings for more experienced users. We should also take into account that it hasn't been updated for a while. Otherwise, ADS Locator provides you with a fast and effective method for finding and extracting alternate data streams from suspicious files.