Detect and report on alternate data streams

[theflakes]

For any file examined, look for alternate data streams and also pull the first X bytes of the stream. Running hunts on the first X bytes would help determine if its a binary, script, or other forensically interesting stuff.

Fields: timestamp device_domain device_name default_hash path size stream_name