Glossary
Alternate Data Stream (ADS)
A second named $DATA stream attached to an NTFS file. Invisible in a normal directory listing, which is exactly why it gets abused and overlooked.
NTFS lets a file carry more than one $DATA attribute. The default stream is
unnamed and holds what you think of as the file's content. Any additional stream
is named, written as filename:streamname, and does not show up in Explorer or
a plain dir.
Windows uses this legitimately. The Zone.Identifier stream is the mark-of-the-web
that triggers the "downloaded from the internet" warning. Attackers use it to
stash payloads behind an innocent-looking file, since the host file's size and
listing never reveal the hidden stream.
If your tooling only reads the default stream, you miss them entirely. The parser lists named streams as child nodes under the file and extracts each one separately, the same way it handles the main $MFT record.