GCED: GIAC Certified Enterprise DefenderDemo

By GIAC · Question Mode

QuestionQ1

Digital Forensics Concepts and Application

You have been asked to search for Alternate Data Streams on the following Windows partitions: 2GB FAT16, 6GB FAT32, and 4GB NTFS. How many total gigabytes and partitions do you need to search?

  • A 4GBs of data, the NTFS partition only.
  • B 12GBs of data, the FAT16, FAT32, and NTFS partitions.
  • C 6GBs of data, the FAT32 partition only.
  • D 10GBs of data, both the FAT32 and NTFS partitions.
Explanation

Alternate Data Streams are supported by NTFS. Therefore, only the 4GB NTFS partition must be searched; the FAT16 and FAT32 partitions do not need an Alternate Data Stream search.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!