Alternate Data Streams

Check this
http//www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=8010
http//code.google.com/p/mft2csv/
http//code.google.com/p/mft2csv/wiki/mft2csv
http//code.google.com/p/mft2csv/wiki/ExtractAllAttributes

jaclaz

Is there an offset in any of the attribute headers, attributes, or MFT header that tells you if a file as an ADS?

You want the $DATA attribute(s) in the $MFT record. The nameless $DATA is the 'standard file contents' (there can be only one of these), while any named $DATA streams are what usually are refered to as ADSs .

You probably also want Brian Carrier's book 'File System Forensic Analysis'.