GCFA: GIAC Certified Forensic AnalystDemo

By GIAC · Question Mode

QuestionQ23

NTFS Artifact Analysis

Adam, a malicious hacker, conceals a hacking tool from his company’s system administrator by using the Alternate Data Streams (ADS) feature. Which statement is true in the context of this scenario?

  • A Alternate Data Streams is a feature of Linux operating system.
  • B Adam is using FAT file system.
  • C Adam is using NTFS file system.
  • D Adam's system runs on Microsoft Windows 98 operating system.
Explanation

Alternate Data Streams are supported by the NTFS file system and can store data in named streams associated with a file, making them a technique for concealing content from ordinary file listings.

Community Discussion

No comments yet. Be the first to start the discussion!