QuestionQ1

Digital Forensics Concepts and Application

You have been asked to search for Alternate Data Streams on the following Windows partitions: 2GB FAT16, 6GB FAT32, and 4GB NTFS. How many total gigabytes and partitions do you need to search?

Explanation

Alternate Data Streams are supported by NTFS. Therefore, only the 4GB NTFS partition must be searched; the FAT16 and FAT32 partitions do not need an Alternate Data Stream search.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!