============================================================
PRACTICAL — ALTERNATE DATA STREAMS (ADS)
============================================================

STEP 1 — Open Command Prompt
- Run CMD as Administrator

------------------------------------------------------------

STEP 2 — Create Working Directory

cd C:\

mkdir ADS_Lab

cd ADS_Lab

------------------------------------------------------------

STEP 3 — Create Normal File

echo This is a normal file. > normal.txt

Verify file:

type normal.txt

------------------------------------------------------------

STEP 4 — Create Hidden ADS Stream

echo Hidden secret data > normal.txt:hidden.txt

Read hidden stream:

more < normal.txt:hidden.txt

------------------------------------------------------------

STEP 5 — Hide Executable Inside ADS

type C:\Windows\System32\calc.exe > normal.txt:calc.exe

------------------------------------------------------------

STEP 6 — Run Hidden Executable

wmic process call create "C:\ADS_Lab\normal.txt:calc.exe"

------------------------------------------------------------

STEP 7 — View ADS Streams

dir /r

------------------------------------------------------------

STEP 8 — Detect ADS Using PowerShell

powershell -command "Get-Item C:\ADS_Lab\normal.txt -Stream *"

------------------------------------------------------------

STEP 9 — Remove ADS Stream

powershell -command "Remove-Item C:\ADS_Lab\normal.txt -Stream hidden.txt"

------------------------------------------------------------

STEP 10 — Verify Removal

dir /r

============================================================
RESULT
============================================================

1. Alternate Data Stream created successfully
2. Hidden data and executable stored inside ADS
3. Hidden executable executed successfully
4. ADS detected using dir /r and PowerShell
5. Hidden stream removed successfully

============================================================
END
============================================================
