http://www.forensicfocus.com/dissecting-ntfs-hidden-streams
The most interesting part is a DLL that adds a "Streams" tab to file properties:
Just download a Visual Studio project from here (self-extracting archive):
http://download.microsoft.com/download/F/C/6/FC6943EB-790A-44AA-B32D-14ED7E22FD5D/NTFSExt.exe
Compile it, and copy resulting StrmExt.dll to Windows\System32 folder along with two scripts: HardLinks.vbs and RWStream.vbs (found in ReleaseMinDependency folder) and then run:
regsvr32 StrmExt.dll
Done!
If you have trouble compiling the project comment out following lines in StdAfx.h:
//#ifndef _WIN32_WINNT
//#define _WIN32_WINNT 0x0400
//#endif
In case you are using 64 bit Windows: create x64 platform configuration and copy settings from Win32 configuration. Compile x64 version (StrmExt.dll still goes to Windows\System32 folder).
