ADS Explorer

A Windows desktop app for personal archivists to discover, inspect, add, and remove NTFS Alternate Data Streams — without Administrator rights.

NTFS Alternate Data Streams (ADS) are named data forks attached to any file or directory on Windows. They are invisible to most tools, silently lost when copying to FAT/exFAT or uploading to the cloud, and occasionally used by Windows itself to store metadata such as the Mark-of-the-Web security zone. ADS Explorer makes them first-class citizens: enumerable, searchable, hashable, extractable, and safely deletable — all as a standard user.

---

Goals

• Volume-wide discovery. Scan a massive personal library in minutes and resurface it in seconds on subsequent runs via an incremental SQLite index. The design targets libraries theoretically exceeding 1 TB, though large-scale performance has not yet been validated on real hardware at that size.
• No elevation, ever. Every operation runs as a standard user. Files the current user cannot access are skipped and counted; a UAC prompt is never shown.
• Write safety. Every read and write goes through documented Win32 file APIs (FindFirstStreamW, CreateFileW with stream syntax, DeleteFileW). Raw volume handles and direct NTFS structure parsing are forbidden. The OS validates every operation; this tool is physically incapable of corrupting a filesystem.
• TBW discipline. Opening a stream never writes bytes to disk unless the user explicitly requests extraction. No silent temp copies.
• Archivist safety net (RecyclerStream). Every stream deletion is backed up before the delete call fires: DRIVE_ROOT\.BlesseDevil\ADS-Scanner\Deleted_Stream\Session-YYYYMMDD_HHMM Backups older than 15 days are automatically purged on startup (configurable: 7 d / 15 d / 30 d / 365 d).
• Portable core. The core crate contains zero Win32 calls and builds cleanly for x86_64-unknown-linux-gnu, keeping a future read-only Linux viewer possible.

---

Phase 1.6 — Desktop UI (Current)

AdsExplorer is a WinUI 3 desktop application that surfaces the Phase 1 backend through a native Windows UI. The Rust core communicates with the C# frontend over a generated C-ABI FFI bridge — no COM, no P/Invoke boilerplate, no managed wrappers around unsafe memory.

This release makes browse mode genuinely usable: a working folder tree, a resizable file list, a live stream inspector, and the first write operations.

What works

Area	Detail
Navigation tree	Drive-rooted folder tree with lazy expansion; stays expanded and selected in sync with the address bar, list, and Back/Forward/Up
File list	Sortable layout with drag-to-resize columns; an orange ADS badge marks files carrying streams
Stream inspector	Per-file stream list with name, size, sniffed content type, and classification (Mark-of-the-Web / System / Integrity / Unknown)
Stream filters	ADS-only view (files with streams) and a Hide system streams toggle (drops Mark-of-the-Web / system metadata)
Add stream	From inline text or a source file; guarded against accidental overwrite
Extract	Export a stream to a chosen location
Open	Extracts to a temp file and launches the default handler, with an "open with" / "open as text" fallback ladder
Delete	Confirmation dialog; RecyclerStream backup fires before removal; the 15-day janitor also runs at GUI startup
Properties	Fluent dialog with file details, copy-to-clipboard fields, and the full stream listing
Navigation	Address bar, search-as-you-type filter, Back / Forward / Up / Refresh

Next (Phase 2 — Explorer-grade browse mode)

Menu bar and reorganized toolbar; theming (a friendlier default blue) under View; Explorer-style New / Copy / Move / Paste with ADS preservation, plus Delete / Sort / multi-view modes; Quick Access and NTFS-drive roots in the tree; status-bar item counts and sizes (with and without streams); a branded startup splash; and a credits/contact panel behind the logo. Background indexing, the Recycler GUI, and the full open/extract pipeline follow in Phase 3.

---

Architecture

The workspace is split into four crates with a strict layering rule: only platform-windows touches Win32, and only ffi crosses the language boundary.

workspace/
  core/               Pure Rust. Scan orchestration, SQLite-backed stream
  │                   index, classifier, magic-byte sniffer, RecyclerStream,
  │                   and BLAKE3 hashing. Zero Win32 calls — builds on Linux.
  │
  │   platform.rs     Platform trait defining the abstraction boundary:
  │                   enumerate_streams · read_stream · read_stream_window
  │                   write_stream · delete_stream · launch
  │
  platform-windows/   Windows-native implementation of the Platform trait.
  │                   All Win32 calls (FindFirstStreamW, CreateFileW,
  │                   DeleteFileW, AssocQueryStringW) live here and nowhere
  │                   else.
  │
  ffi/                C-ABI cdylib over core. csbindgen generates matching
  │                   C# bindings at build time. Plain C structs only —
  │                   no Rust types cross the boundary.
  │
  cli/                Clap-powered CLI. Wires core + platform-windows for
  │                   terminal use (full Phase 1 command set).
  │
  ui-winui/           C# WinUI 3 desktop frontend. Consumes the csbindgen
                      bindings; never calls Win32 directly.

Data flow (GUI path): ui-winui (C#) → FFI bindings → ffi cdylib → core logic → platform-windows Win32 calls

The Platform trait is the only seam between portable logic and the OS. Replacing platform-windows with a read-only implementation is the only change needed for a future Linux viewer.

---

Download

Grab the latest AdsExplorer-vX.X.X-win-x64.zip from Releases. Extract anywhere, then:

1. Run AdsExplorer.exe from the extracted folder (all DLLs must stay alongside the exe).
2. Optionally, right-click CreateShortcut.ps1 → Run with PowerShell to place a desktop shortcut.

Note: Windows SmartScreen may warn "Unknown publisher" — click More info → Run anyway. If the app fails to start on a clean machine, install the Visual C++ x64 Redistributable.

---

Building from source

Requires the Rust toolchain and the .NET SDK with the Windows App SDK. The desktop app is x64.

# Rust core, CLI, and the FFI bridge (also regenerates the C# bindings)
cargo build --release

# Desktop app (build x64 — AnyCPU/Win32 is not supported)
dotnet build ui-winui/AdsExplorer.csproj -c Debug -p:Platform=x64
dotnet run   --project ui-winui/AdsExplorer.csproj -c Debug -p:Platform=x64

---

CLI reference

The full command-line interface from Phase 1 remains available alongside the GUI. Build and run from source (or use cli.exe after cargo build --release):

cargo run --bin cli -- [COMMAND]

Command	Syntax	Notes
scan	scan <ROOT>	Index all ADS under <ROOT>; incremental on rescan
list	list [--filter <CLASS>]	Classes: Mark-of-the-Web, System/Windows, Integrity, Unknown
extract	extract "<HOST>:<STREAM>" <OUTPUT>	Byte-for-byte copy via CreateFileW
add	add <HOST> <STREAM_NAME> <CONTENT> [--force]	<CONTENT> is an inline string; --force overwrites an existing stream
delete	delete "<HOST>:<STREAM>" --confirm	RecyclerStream backup fires before deletion; --confirm required
hash	hash "<HOST>:<STREAM>" [--blake3]	BLAKE3 only in Phase 1; --blake3 flag accepted for compatibility
open	open "<HOST>:<STREAM>"	Sniffs type → resolves handler → launches with colon path; prints manual extraction hint on failure
recycler-stats	recycler-stats [--drive <ROOT>]	Default drive: C:\
recycler-clear	recycler-clear [--drive <ROOT>] --confirm	Wipes entire backup tree; --confirm required

Running the tests

# Unit tests (no elevation needed)
cargo test --workspace

# End-to-end stream round-trip in a scratch folder
.\plant_streams.ps1
cargo run --bin cli -- scan .\test_env
cargo run --bin cli -- list

---

Safety guarantees

The measures below are built into every code path. That said, this software is still in active development — always test on a dedicated test environment before running against a library you care about.

Guarantee	How it is enforced
No Administrator rights	Standard-user Win32 calls only; access-denied entries are skipped and tallied
No raw volume access	\\.\C: handles are forbidden; every I/O goes through the file-path namespace
No silent disk writes	Streams are read into memory for display/hashing; extraction requires explicit user confirmation
Deletion is reversible	RecyclerStream backup precedes every DeleteFileW call; auto-purge keeps backups for 15 days by default
Timestamp side-effect disclosed	Writing or deleting a stream updates the host file's modified time. This is harmless but will make backup tools re-copy the host — an in-app notice for it is planned (Phase 2)

Proceed with caution. These guarantees reflect design intent and the Win32 contracts the OS enforces. They do not substitute for your own verification. Run plant_streams.ps1 in a scratch folder, exercise each operation, and confirm the behavior matches your expectations before pointing ADS Explorer at real data.

---

Licensing

ADS Explorer is dual-licensed.

• Open source: GNU Affero General Public License v3.0 — free for personal, academic, and open-source use with source-disclosure obligations.
• Commercial: A separate commercial license is available for use cases that cannot comply with AGPLv3. See COMMERCIAL-LICENSE.md for terms.

Contributions require a Contributor License Agreement. See CONTRIBUTING.md.