On: Windows NTFS Tricks Collection

[orf]

They are used extensively in SQL server, as well as Windows itself. It's a pretty fundamental part of the NTFS design and you can't just drop it.

ADS underpins pretty much every FS operation on windows, including listing directories. MacOS has something similar.

[dataflow → orf]

> They are used extensively in [...] Windows itself. ADS underpins pretty much every FS operation on windows, including listing directories.

I think you might be confusing alternate data streams with NTFS attributes (not to be confused with file attributes or extended attributes). i.e. Paths are formatted as \PARENT\NAME:STREAM:$ATTRIBUTE and I think you're thinking about the :$ATTRIBUTE portion (like $DATA, $INDEX_ALLOCATION, etc.) rather than the :ADS portion, because as far as I know Windows does not use ADS extensively by any means. I've only seen a handful of uses in the OS. Or maybe you mean the fact that directory $INDEX_ROOT and $INDEX_ALLOCATION attributes are used with a stream called $I30, but I don't see why that's "underpinning" anything in any way... they could just drop the ability to create any other streams and it wouldn't affect this.

[londons_explore → orf]

You could drop it from being accessible to usermode applications, and have only the kernel/whitelisted binaries able to use them.

Existing usecases could be replaced with new attributes or syscalls where they can't be avoided.