What is the usage of Stream: portion in View==>File==>Open File window? For some files it shows main:Zone.Identifier:$DATAwhat's the meaning of this?
OllyDbg2: What is the meaning of Stream in File View Window?
ollydbg
An NTFS file can have multiple data streams. $DATA is the name of the default stream.From Wikipedia: Internet explorer, (and, according to the german wikipedia, newer versions of Firefox), use the Zone.Identifier stream to store information from where you downloaded the file. You might have seen the File Origin: downloaded from internet message in a UAC prompt. You can edit the Zone.Identifier data with notepad. For example, on one of your files that have this attribute, run notepad myfile.exe:Zone.Identifier. This should give you something like[ZoneTransfer]ZoneId=3Change the 3 to a 0, then save from notepad. Next time you run the file as adminstrator, the Origin: Internet message will change to Origin: this computer's hard disk.The answer to your question why is it absent on some other files is - only NTFS supports this. If you copy a file to a USB stick, SD card, or network storage, the file will lose its stream; when you copy it back, it doesn't magically gain the stream back. So only files that you downloaded via internet explorer (and possibly other browsers) on your NTFS hard disk will have it. Or, of course, files in which you created the stream yourself, like in echo this is a fake > myfile.exe:Zone.Identifier.Of course, the only thing this has to do with reverse engineering is that Ollydbg is one of the few tools that tell you if a file as alternate data streams.