nerdexam
GIAC

GCFA · Question #205

Adam, a malicious hacker, hides a hacking tool from a system administrator of his company by using Alternate Data Streams (ADS) feature. Which of the following statements is true in context with the a

The correct answer is C. Adam is using NTFS file system.. Alternate Data Streams (ADS) is an NTFS-exclusive feature that allows data to be hidden within file streams, making it a technique used to conceal malicious tools on Windows systems.

File System & Registry Forensics

Question

Adam, a malicious hacker, hides a hacking tool from a system administrator of his company by using Alternate Data Streams (ADS) feature. Which of the following statements is true in context with the above scenario?

Options

  • AAlternate Data Streams is a feature of Linux operating system.
  • BAdam is using FAT file system.
  • CAdam is using NTFS file system.
  • DAdam's system runs on Microsoft Windows 98 operating system.

How the community answered

(38 responses)
  • A
    13% (5)
  • B
    5% (2)
  • C
    79% (30)
  • D
    3% (1)

Why each option

Alternate Data Streams (ADS) is an NTFS-exclusive feature that allows data to be hidden within file streams, making it a technique used to conceal malicious tools on Windows systems.

AAlternate Data Streams is a feature of Linux operating system.

ADS is not a Linux filesystem feature; it is specific to Microsoft's NTFS and has no equivalent in Linux filesystems such as ext4 or XFS.

BAdam is using FAT file system.

FAT and FAT32 file systems do not support Alternate Data Streams; only NTFS provides this functionality.

CAdam is using NTFS file system.Correct

NTFS (New Technology File System) supports Alternate Data Streams, which allow additional data streams to be attached to a file without changing its visible size or appearance in the filesystem. This feature is exclusive to NTFS and is commonly exploited by attackers to hide files, executables, or data from casual inspection by administrators.

DAdam's system runs on Microsoft Windows 98 operating system.

Windows 98 uses FAT32 as its primary filesystem and does not natively support NTFS, meaning ADS would not be available on that operating system.

Concept tested: NTFS Alternate Data Streams for data hiding

Source: https://learn.microsoft.com/en-us/sysinternals/downloads/streams

Topics

#Alternate Data Streams#NTFS#anti-forensics#data hiding

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCFA Practice