>>336
look up on Windows's NTFS Alternate Data Streams (NTFS ADS). it is an invisible sidecar file that attaches to any file format. it doesnt alter the original file hashes. NTFS-3G on Linux can read it and you can also convert it to xattrs when migrating to POSIX filesystem.

another use for NTFS ADS? if you downloaded a file from Firefox/Edge/Chrome on Windows without using incognito mode, the browser will attach an NTFS ADS metadata that contains the original file's download URL and referer URL.

check this out:
>open Windows CMD
>navigate to your Downloads folder.
>run: dir /r
>you'll see some hidden files ending with :Zone.Identifier:$DATA e.g: file.ext:Zone.Identifier:$DATA
>then run: more < "file.ext:Zone.Identifier:$DATA" (include the quotes)
>???
>shit bricks

some say this is glowie shit. but personally i think its neat. there are many timmes that i wish to know where the fuck a file came from and this saved my ass many times. if you're paranoid, use incognito mode and Windows will not save the hidden metadata.

>>337