Executive Summary
A recent forensic investigation has highlighted a sophisticated evasion technique where malware executed from an NTFS Alternate Data Stream (ADS) results in a 'hidden' Prefetch artifact. Instead of creating a standard .pf file in the Prefetch directory, the Windows operating system creates a 0-byte placeholder file (named after the host file) and stores the actual Prefetch data within a named stream attached to that placeholder. This behavior can lead security analysts to incorrectly conclude that no execution occurred if they rely solely on standard directory listings.
Technically, when a process is launched via a path like `image.png:malware.exe`, the resulting Prefetch record is named `image.png:malware.exe-[HASH].pf`. Because NTFS interprets the colon as a stream delimiter, the forensic evidence is bifurcated: a visible but empty host file and a hidden data stream containing the execution history. This technique exploits the fact that many automated forensic collectors and manual reviews overlook non-default NTFS streams.
This finding is critical for Incident Response teams as it demonstrates how standard host-based artifacts can be manipulated without active anti-forensics by the attacker, but rather through the inherent way Windows handles ADS paths. Failure to account for these streams during collection or analysis can result in a total loss of visibility into the adversary's execution timeline.