nerdexam
GIAC

GCFA · Question #46

You are handling technical support calls for an insurance company. A user calls you complaining that he cannot open a file, and that the file name appears in green while opening in Windows Explorer. W

The correct answer is A. The file is encrypted.. In Windows Explorer, file names displayed in green indicate the file is encrypted using the Encrypting File System (EFS).

Advanced Windows Artifacts & Browser Forensics

Question

You are handling technical support calls for an insurance company. A user calls you complaining that he cannot open a file, and that the file name appears in green while opening in Windows Explorer. What does this mean?

Options

  • AThe file is encrypted.
  • BThe file belongs to another user.
  • CThe file is infected with virus.
  • DThe file is compressed.

How the community answered

(39 responses)
  • A
    72% (28)
  • B
    18% (7)
  • C
    3% (1)
  • D
    8% (3)

Why each option

In Windows Explorer, file names displayed in green indicate the file is encrypted using the Encrypting File System (EFS).

AThe file is encrypted.Correct

Windows uses green text in Explorer to visually distinguish files encrypted with EFS (Encrypting File System), a feature of NTFS. EFS encrypts file contents so only the user who encrypted the file (or authorized recovery agents) can access them. Blue text is used for compressed files, making the color distinction an important diagnostic indicator.

BThe file belongs to another user.

Windows Explorer does not use green coloring to indicate file ownership by another user - permissions are shown via Properties dialogs, not color coding.

CThe file is infected with virus.

Windows does not use any built-in color coding in Explorer to indicate virus infection - that is a feature of third-party antivirus software.

DThe file is compressed.

Compressed files (NTFS compression) are displayed in blue in Windows Explorer, not green.

Concept tested: Windows Explorer EFS encryption color indicator

Source: https://learn.microsoft.com/en-us/windows/win32/fileio/file-encryption

Topics

#EFS#Windows Explorer#file encryption#file color indicator

Community Discussion

No community discussion yet for this question.

Full GCFA Practice