Linux 7.4 NTFS driver gains Alternate Data Streams support with new ioctl interfaces

The NTFS kernel driver introduced in Linux 7.1 receives its most significant update yet in Linux 7.4 with full support for NTFS Alternate Data Streams (ADS), a feature that allows multiple data streams to be stored within a single file. This capability, long present in Windows NTFS, enables storage of hidden metadata, security flags, and backup revisions, but has also been historically exploited for malware concealment. The Linux implementation adds new ioctl interfaces that allow user-space applications to enumerate, read, write, and remove these streams on mounted NTFS volumes.

Beyond ADS, Linux 7.4's NTFS driver expands functionality with FS_IOC_GETFLAGS and FS_IOC_SETFLAGS support for file attribute queries and updates, FS_IOC_GETFSUUID for exposing volume serial numbers, and the ability to mount hibernated volumes. A new "streams_interface=windows" mount option enables access via the familiar Windows [file]:[stream-name] syntax, improving cross-platform compatibility for users working with dual-boot systems or external drives formatted under Windows.

NTFS driver changes in Linux 7.4

• Alternate Data Streams (ADS): Full kernel support for NTFS multiple $DATA attributes per file, with new ioctl interfaces enabling stream enumeration, reading, writing, and removal from user-space on open files.
• Windows-compatible stream access: The "streams_interface=windows" mount option exposes ADS via [file]:[stream-name] syntax, matching Windows conventions for cross-platform workflows.
• File attribute ioctl support: New FS_IOC_GETFLAGS and FS_IOC_SETFLAGS implementations allow querying and modifying NTFS file attributes from Linux user-space.
• Volume identification: FS_IOC_GETFSUUID now exposes the NTFS volume serial number, improving integration with tools that depend on stable filesystem UUIDs.
• Hibernated volume mounting: The driver gains support for mounting NTFS volumes that were left in hibernation state by Windows, reducing boot-time friction for dual-boot configurations.

Why it matters

For Linux users managing dual-boot systems, external drives, or enterprise data migration from Windows infrastructure, ADS support eliminates a long-standing compatibility gap that could cause metadata loss or security blind spots when handling NTFS volumes. The new ioctl interfaces also enable backup tools, forensic software, and cross-platform antivirus solutions to properly inspect and manage hidden data streams that were previously invisible to Linux systems.