Did you know that you’ve been looking at Windows files the wrong way? In every modern NTFS drive, Microsoft includes a 33-year-old feature that can make your files carry extra data you may never see.

This isn’t a hidden setting or configuration that lies deep within the Windows Registry. It’s just right there, attached to the ordinary documents and downloads that you have on your desktop right now.

The moment you know how to look, it changes how you think about everyday files because they may disclose information you didn’t expect.

The file you can see is only half the file

One command exposes the part File Explorer never shows you

Do this right now.

1. Open File Explorer and navigate to any folder where you want to run this test, then right-click anywhere in that folder and navigate to New -> Text Document.
2. Type a sentence (maybe “This is the normal visible content”).
3. Name the file test.txt (I’ll use this name throughout), then save it and close it.

So far, on the surface, nothing stands out; this is a process you do almost every day. Now, do something extra:

1. Open Command Prompt in the folder where you created the file. An easy way to do this is to open that folder in File Explorer, click the address bar, type cmd, and press Enter. Keep this Command Prompt window open; you’ll return to it in a moment.
2. From that directory, run this command: notepad test.txt:secret.txt.
3. Input some text into this window (for instance, “This is the hidden part”), then save it and close Notepad.

You have just successfully created an alternate stream.

Now switch back to File Explorer and open test.txt normally. Nothing still stands out, and you’ll still see the single sentence you wrote. Right-clicking the original file and opening Properties, or even checking the file’s size in Explorer, doesn’t indicate anything unusual.

Now return to the Command Prompt you left open:

1. Run dir. You’ll get a complete list of files and subfolders contained within the directory, including the original file you created and nothing more.
2. Run dir /r. Just underneath test.txt, you should see an additional line with a value ending in $DATA. This is the stream you just wrote, with its own size and name attached to the same file.

You’re not looking at a second file hiding inside the first one. You just exposed a second stream that is attached to the same file record.

With NTFS, every file has a default data stream where its ordinary content goes, but the file system also supports additional named streams attached to that file. The filename, icon, and file size provide no clues that a second stream is present, and Explorer wasn’t designed to show this extra data.

Your downloads can carry a trace of where they came from

Zone.Identifier is the stream Windows uses to mark downloads

Now you may take this a step further and try it on a file that you never created, maybe something you downloaded. So perhaps open the Command Prompt in the Downloads folder and run dir /r. On many files you’ve downloaded, you’ll have a new stream called Zone.Identifier. You can read it directly using the command below (add the actual PDF name in place of “AI Disclosure Form – Module Projects (1).pdf”):

notepad AI Disclosure Form - Module Projects (1).pdf:Zone.Identifier

In the text file that opens, a line should read something like ZoneId=3. You may also get additional lines for HostUrl and a ReferrerUrl, which point to the actual website the file came from, and all these sit in a stream you’ve never noticed.

The number three tells Windows that the file came from the “Internet zone” (that’s what ZoneId=3 means) rather than being created locally. It’s the same mechanism Windows uses to show security information in a downloaded file’s properties.

This file came from another computer and might be blocked to help protect this computer.

That Mark of the Web information can cause certain applications and the OS itself to restrict or warn you about content from the internet.

Alternate data streams are an NTFS file system feature and Zone.Identifier is one stream Windows can use to store Mark of the Web information. While most people assume this is a hiding spot for malware, Windows leans on it to warn you about potentially unsafe files.

The blind spot attackers actually use

Why a file pulled out of an ISO doesn’t get the same warning

The logical next question is whether it’s possible for Windows to include a security note in a place the File Explorer doesn’t show; what stops an attacker from replicating this?

When files are extracted from a mounted ISO or IMG file, they don’t always reliably pick up the same Zone.Identifier that traditional downloads do. If a file doesn’t get tagged, it doesn’t trigger a warning that can stop it. Attackers increasingly favored sending ISO attachments rather than plain documents after Microsoft began blocking macros in files downloaded from the internet by default.

Even though a stream doesn’t show up in File Explorer, security tools can still detect streams. In fact, security tools now specially watch for streams being created. Sysmon (a free Microsoft tool that many security teams install) has an entire event type that logs when these streams are created.

The file was never just “the file”

There’s a final test you may run. Attach the test.txt file with its extra stream to an email and download it to a different location, or copy it onto a FAT32 flash drive, which doesn’t support alternate data streams. You’d notice that while the visible element remains constant, the extra stream is gone when you run dir /r. The survival of that additional layer depends entirely on the file system and the tools you use to copy.

When I figured this out, it dawned on me that there’s always been a secret system that knows more about my files than it readily discloses to me. There’s nothing you need to do about it; it’s unlikely to be a problem for most people, but it’s a part of the NTFS file system that you likely never knew about.