Hex Editor - Binary File Editing Software for Windows
Docs

Searching for Streams

Hex Editor Neo provides you with a powerful feature that allows you to locate all files (according to a given criteria) that have alternate data streams in them. It can also be used to quickly calculate a total space occupied by streams on your disk. Found streams may then be opened in the editor or deleted.

Find Streams

Execute the Tools » Find Streams… command to start searching for streams.

Provide a folder or a list of folders (separated by semicolon) in the Search In box. You may also press the Browse button to open up the Folder List Window where you can visually select folders.

Use the File types box to specify the mask. You may specify several masks, separated by semicolons. This mask is used only to filter files, not streams.

You may limit a search by defining the lower bound for a stream size, either in bytes, KBytes, MBytes or GBytes in the Larger than box.

Exclude box lets you enter the regular expression used to exclude located streams. The predefined value (Zone.Identifier)|(encryptable)|(favicon) excludes streams Zone.Identifier, encryptable and favicon, as the system widely uses them and their size is small.

Include sub-folders option may be used to search deep into the selected folders.

When you finish configuring searching options, click the OK button.

Search Process and Results

As soon as you start searching for streams, the NTFS Streams Tool Window enters the search mode. In this mode it stops displaying streams of the active document and starts displaying streams satisfying your criteria. The last line in the list always tells you how much streams were found, how much files and folders scanned and total streams size. You may abort searching by executing the NTFS Streams » Cancel Current Operation command.

When the search is finished, all matched streams are displayed in the list. You may sort the list by clicking on any column.

To open a stream (or several streams) in the editor, select it (or them) and execute the NTFS Streams » Open Stream(s) command. All selected streams are opened in the editor. You may edit them as you edit normal files.

To delete a stream (or several streams), select it (or them) in the list and execute the NTFS Streams » Delete Stream(s)… command. Please note that the delete operation cannot be undone.

To exit a search mode execute the NTFS Streams » Exit Find Streams Mode command.