hooge

ADSDump.exe is forensic tool that dumps all ADS stream for a file.

It identifies suspicious stream names and abnormally long streams for a file. It is used to check if you have possible malware stuffed into a stream. It dumps the stream in text (if it can), with option to force binary and hex format dumps.

Use this as a basis to understand dolphin and whale communication!