Alternate Data Streams have been around since 1993, when they were introduced in NTFS on Windows NT 3.1.  They were introduced as a mechanism to store resource information separate from the actual file data.  This allows programs to associate metadata with the file without changing the actual file contents.

It is also a simple and effective way of hiding information.  Most people are unaware of this feature, most likely due to it being an NTFS only feature under Windows.  Malicious software can use this feature to hide their files.

Alternate Data Streams are amazingly simple to create.  This is an example using notepad.

First, let’s create a simple file.

c:\temp> echo "Hello world!" > file.txt

Do a directory listing to see how big the file is:

c:\temp> dir

 Directory of C:\temp

...
03/29/2007  01:39 PM                17 file.txt

... 

Now, let's create an alternate data stream in the file we just created. The ":" is the key to creating an alternate data stream. Any valid filename can follow the colon:

c:\temp> notepad file.txt:hidden.txt

Notice how notepad asks you if you want to create this new file. Click "Yes".  Now, type some text in notepad, save the file and close notepad.

Do another directory listing to see how big the file is now:

c:\temp> dir

 Directory of C:\temp

...
03/29/2007  01:42 PM                17 file.txt

... 

Up until recently you needed to use a 3rd party utility to view these alternate data streams.  One such utility is LADS (List Alternate Data Streams): http://www.heysoft.de/Frames/f_sw_la_en.htm.

With the introduction of Windows Vista however, the dir command is now alternate data stream aware with "/r":

c:\temp> dir /r

 Directory of C:\temp

...
03/29/2007  01:42 PM                17 file.txt

                                     8 file.txt:hidden.txt:$DATA

...

Note that the file contained within the alternate data stream is now shown.  It's not much, but it is something at least. Utilities such as LADS will still be necessary to search for all the files that contain alternate data streams.

The size of the data contained in the alternate data stream is only limited by the file system.  You can store multiple alternate data streams in a file.  You can also store alternate data streams inside folders and drives.

Notice that the timestamp changed, but the size of the file remained the same. There is no indication that there is anything else contained within file.txt.  Up until recently, your only option was to download 3rd party utilities to find alternate data streams.