Merged back in Linux 7.1 was the new NTFS kernel driver implementation for better supporting Microsoft's NTFS file-system on Linux. Since then new features and improvements have continued to land for this NTFS driver with some more notable additions also coming in Linux 7.4.
One of the main changes for the modern NTFS driver in Linux 7.4 is supporting NTFS' Alternate Data Stream (ADS) functionality. NTFS supports the notion of storing more than one stream of data per file. It's essentially hidden data within a file accessible via named streams and can be used for housing extra metadata, security flags, and more. NTFS ADS can also be used for other uses like was used as part of Apple HFS support and carrying multiple revisions of a file such as for backup software. But NTFS ADS has also been exploited for hiding malware on Windows systems and other malicious purposes with these hidden streams.
With Linux 7.4, the NTFS driver now has support for Alternate Data Streams and adds new ioctl interfaces so Linux user-space can access these streams / multiple $DATA attributes. The new interfaces allow for stream enumeration, reading, writing, and removal on NTFS-backed files that are opened.
When an NTFS file-system is mounted by thiss driver with the new "streams_interface=windows" mount option it also allows for reading/writing to streams via the Windows syntax of [file]:[stream-name], e.g:
This Alternate Data Stream support is the biggest addition to the Linux NTFS driver for the v7.4 kernel. Another feature though is also support for file attribute queries and updates via the FS_IOC_GETFLAGS and FS_IOC_SETFLAGS flags.
Plus now exposing the NTFS volume serial number via FS_IOC_GETFSUUID, validation and compatibility enhancements, support for mounting hibernated volumes, and various fixes. The full list of NTFS driver changes for Linux 7.4 via this pull request.