GCFA: GIAC Certified Forensic Analyst

By GIAC · Question Mode

QuestionQ23

NTFS Artifact Analysis

Adam, a malicious hacker, conceals a hacking tool from his company’s system administrator by using the Alternate Data Streams (ADS) feature. Which statement is true in the context of this scenario?

Explanation

Alternate Data Streams are supported by the NTFS file system and can store data in named streams associated with a file, making them a technique for concealing content from ordinary file listings.

Community Discussion

No comments yet. Be the first to start the discussion!