GIAC
GCIH · Question #492
Which command will reveal the contents of slackspace.txt? C:\> notepad C:\Users\tadams\Documents\GCIH_update.txt:slackspace.txt
The correct answer is C. C:\> more < C:\Users\tadams\Documents\GCIH_update.txt:slackspace.txt. Slackspace.txt is an alternate data stream (ADS), a secondary file stream of GCIH_update.txt. The more command will reveal the text content of an ADS if the full path is used.
Malware Analysis & Advanced Persistent Threats
Question
Which command will reveal the contents of slackspace.txt? C:> notepad C:\Users\tadams\Documents\GCIH_update.txt:slackspace.txt
Options
- AC:\Users\tadams\Documents> notepad slackspace.txt
- BC:> type C:\Users\tadams\Documents\GCIH_update.txt:slackspace.txt
- CC:> more < C:\Users\tadams\Documents\GCIH_update.txt:slackspace.txt
- DC:\Users\tadams\Documents> tail slackspace.txt
How the community answered
(56 responses)- A4% (2)
- B2% (1)
- C93% (52)
- D2% (1)
Explanation
Slackspace.txt is an alternate data stream (ADS), a secondary file stream of GCIH_update.txt. The more command will reveal the text content of an ADS if the full path is used.
Topics
#NTFS alternate data streams#slack space#Windows forensics#data hiding
Community Discussion
No community discussion yet for this question.