Basically it is a method of storing data in hidden files that are attached to normal files. These hidden files can't be seen, whereas the parent files (non-hidden ones) can. This means that so long as your parent file isn't an obvious or suspicious name, you can keep things hidden quite well. The size of your hidden files also won't show up, so they can be quite large.
This means your "hacking" tools can be hidden quite easily and run under the guise of a legitimate process. If this is named well then the user may be reluctant to delete the parent file, which is really hiding your hidden file.
You would need a different parent for each hidden file, but like I say, so long as it isn't suspicious then you should be right.
Also, this technique (I guess you could call it one) isn't very well known, which also means you should be able to stay undetected for longer.
I'm not personally going to run through the method, as there is no point. I wanted to provide you with an overall picture and some sort of introduction, both of which I hope were useful.
For further information and taking advantage of ADS, please check out:
http://www.diamondcs.com.au/index.php?page...id=ntfs-streams
http://patriot.net/~carvdawg/docs/dark_side.html
Have fun with it!
