How Hackers hide files on Windows 10 and Linux

NetworkChuck Technology Careers Career & Money

About this video

Presented as an ethical-hacking lesson with an explicit warning not to hack anyone without permission, this video demonstrates two ways to hide a file inside another file. On Windows, he uses Alternate Data Streams, a feature of the NTFS file system: from the command prompt he creates a secret text file and a decoy text file, then uses the type command with a colon syntax to attach the secret file as an alternate stream of the decoy, and deletes the original. The hidden file does not show in a normal directory listing or when the decoy is opened normally, but opening the decoy with the stream name appended reveals it, and running dir /r exposes alternate data streams to an admin looking for them. He also shows the simpler attrib +h method for making a file hidden. On Kali Linux, he demonstrates steganography with steghide: after installing it with apt, he embeds a secret text file inside an innocent-looking JPEG using steghide embed with a cover file and embedded file, protected by a password, then removes the original and later extracts the secret again with steghide and the password while the picture still looks unchanged. He closes by stressing that both techniques are old and well known, that scanners and forensic tools will find ADS-hidden files easily, but that concepts like ADS in NTFS are still expected knowledge for certifications such as CEH and for understanding how attackers cover their tracks.

Key takeaways

Alternate Data Streams in NTFS let one file be hidden inside another on Windows using the type command and a colon followed by the stream name
A normal dir listing hides alternate streams, but dir /r reveals them, so ADS hiding fools casual users, not investigators
The attrib +h command hides a file in Explorer, but enabling ‘show hidden files’ defeats it
On Kali Linux, steghide embed can hide a password-protected file inside a JPEG, and steghide with the same password extracts it while the image looks normal
Both methods are long-established and easily detected by scanners and forensic tools, but remain important foundational knowledge for ethical hacking study

Episode details: published September 14, 2020 · 9:51 long. Summary written by Self Growth Videos from the episode itself. Business results and any income figures mentioned are NetworkChuck’s own claims, shared for education — they are not typical or guaranteed.

← Previous: 5G will change gaming FOREVER · Next: DO NOT design your network like this!! // FREE CCNA // EP 6 →

All NetworkChuck videos · NetworkChuck profile · NetworkChuck on YouTube