NTFS sets a flag for the file once you encrypt it and creates an EFS attribute where it stores Data Decryption Field (DDF) and Data Recovery Field (DDR). Which of the following is not a part of DDF?

The correct answer is B. Checksum. In NTFS Encrypting File System (EFS), once a file is encrypted, the system stores a Data Decryption Field (DDF) and a Data Recovery Field (DDR) in the EFS attribute. The DDF contains: the Encrypted FEK (the File Encryption Key encrypted with the user's public key), the EFS…

Submitted by ricky.ec· Apr 18, 2026Disk Forensics

Question

Options

AEncrypted FEK
BChecksum
CEFS Certificate Hash
DContainer Name

How the community answered

(29 responses)

B
93% (27)
C
3% (1)
D
3% (1)

Explanation

In NTFS Encrypting File System (EFS), once a file is encrypted, the system stores a Data Decryption Field (DDF) and a Data Recovery Field (DDR) in the EFS attribute. The DDF contains: the Encrypted FEK (the File Encryption Key encrypted with the user's public key), the EFS Certificate Hash (a reference to the user's EFS certificate used for encryption), and the Container Name (identifying the cryptographic key container). A Checksum is not a component of the DDF structure - checksums serve as integrity verification values and are not part of the EFS key storage metadata.

Topics

#NTFS#EFS#Data Decryption Field (DDF)#File Encryption

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice