MFT information for alternate data stream names

Question

I have been working on retrieving file information from MFT. I see that the MFT record has info regarding standard info, file names, data and few other attributes. I tried parsing the MFT record to get all the details that it contains. I am able to get filename, data (including data for alternate streams) for all files but I was not able to obtain the filenames for the named alternate data streams. For the purpose of testing I created a file with two named alternate streams containing data. When I parsed the MFT record corresponding to the file I was not able to identify the alternate stream names. Does that mean the alternate stream names are not stored in the MFT? Then how does some utilities such as stream.exe identify the alternate stream names?

Answer 1

If you're parsing the attributes yourself you can find the offset to the name of the attributes in their common header. There is a WORD value in the header at offset 0x0A of the attribute if I'm not mistaken (I found it here). The offset points to the name of the attribute. The attribute header size + the length of the attribute name + the length of the data (data run if not resident, actual data otherwise) should match the attribute length stored in the common header field (offset 0x04).

If you're using the Windows API you can use the FindFirstStreamW function on a file to get it's streams. It usually returns a WIN32_FIND_STREAM_DATA structure that contains the name of the stream.