Windows NTFS supports the file stream. You basically add data to a file, outside the file, and you cannot view it normally. When you created the file "word1: word2", the hidden stream "word2" is attached to "word1". If you copied the word1 file to another NTFS machine, the word2 data will come with you
Go here http://technet.microsoft.com/en-us/sysinternals/bb897440.aspx and download the thread program. Running it, you will see that word2 is the thread associated with word1
This page also talks about streams: http://www.forensicfocus.com/dissecting-ntfs-hidden-streams
To really prove this, you can use Notepad, but you need to use the .txt extension:
file=open('word1.txt:word2.txt','w') file.write('Testing streams') file.close()
Now, using the cmd program, change directories to where you created the files. Enter the following:
c:\tmp> notepad word1.txt
You will see an empty file. Now try the following:
c:\tmp> notepad word1.txt:word2.txt
You should see the text Testing streams .
source share