312-49 · Question #168
What type of file is represented by a colon (:) with a name following it in the Master File Table (MFT) of an NTFS disk?
The correct answer is B. Data stream file. In NTFS, the colon (:) notation after a filename in the Master File Table represents an Alternate Data Stream (ADS), also called a data stream file. For example, 'document.txt:hidden_data' indicates a secondary stream attached to the main file. ADS is a legitimate NTFS feature…
Question
What type of file is represented by a colon (:) with a name following it in the Master File Table (MFT) of an NTFS disk?
Options
- ACompressed file
- BData stream file
- CEncrypted file
- DReserved file
How the community answered
(26 responses)- A8% (2)
- B88% (23)
- D4% (1)
Explanation
In NTFS, the colon (:) notation after a filename in the Master File Table represents an Alternate Data Stream (ADS), also called a data stream file. For example, 'document.txt:hidden_data' indicates a secondary stream attached to the main file. ADS is a legitimate NTFS feature that allows multiple data streams to be associated with a single file entry, but it is also commonly exploited by attackers and malware to hide data because the alternate stream is not visible through normal directory listings or Windows Explorer. Forensic investigators must specifically look for ADS entries in the MFT to uncover potentially hidden evidence. This is not related to compression, encryption, or reserved file status.
Topics
Community Discussion
No community discussion yet for this question.