What feature of Windows is the following command trying to utilize?

The correct answer is C. ADS. The command is attempting to use Alternate Data Streams (ADS), a feature of the NTFS file system in Windows. ADS allows data to be hidden within a file by appending a colon and a secondary stream name (e.g., 'file.txt:hidden.txt'). This technique is commonly used to conceal…

Submitted by deeparc· Apr 18, 2026Disk Forensics

Question

Exhibit

Options

AWhite space
BAFS
CADS
DSlack file

How the community answered

(36 responses)

A
3% (1)
C
94% (34)
D
3% (1)

Explanation

The command is attempting to use Alternate Data Streams (ADS), a feature of the NTFS file system in Windows. ADS allows data to be hidden within a file by appending a colon and a secondary stream name (e.g., 'file.txt:hidden.txt'). This technique is commonly used to conceal malicious payloads or data because the hidden stream does not appear in standard directory listings or file size reports. Forensic investigators must be aware of ADS when examining NTFS volumes, as it is a known anti-forensics technique.

Topics

#Alternate Data Streams (ADS)#NTFS#Data hiding#Windows forensics

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice