1. Microsoft Corporation. (2021). File Streams. Microsoft Docs. Retrieved from https://docs.microsoft.com/en-us/windows/win32/fileio/file-streams. This document explains that NTFS files can contain multiple data streams and describes the filename:streamname syntax for accessing them.
2. Carrier, B. (2005). File System Forensic Analysis. Addison-Wesley Professional. In Chapter 10, "NTFS Concepts," the section on "Alternate Data Streams" (pp. 289-291) details how ADS works, its structure within the MFT, and its use for hiding data, including creation via command-line redirection.
3. Russinovich, M., & Solomon, D. A. (2012). Windows Internals, Part 2 (6th ed.). Microsoft Press. Chapter 12, "File Systems," describes the architecture of NTFS, including its support for multiple data streams per file as a fundamental feature (p. 418).