When NTFS added in support for ADS (alternate data streams) I was doing forensics for corporate customers out in California. In 10 years I never did encounter a case where someone was using ADS to hide data, but I was always hoping to.