GIAC
GCFE · Question #115
What is the forensic relevance of 'alternate data streams' in NTFS filesystems?
The correct answer is A. They can be used to store additional data hidden from normal file browsing utilities, posing a. See the full explanation below for the reasoning.
Question
What is the forensic relevance of 'alternate data streams' in NTFS filesystems?
Options
- AThey can be used to store additional data hidden from normal file browsing utilities, posing a
- BThey provide a history of user interface settings adjustments.
- CThey track installation of browser extensions.
- DThey log firewall and antivirus status updates.
How the community answered
(39 responses)- A74% (29)
- B13% (5)
- C8% (3)
- D5% (2)
Community Discussion
No community discussion yet for this question.