nerdexam
GIAC

GCIH · Question #543

Which is a requirement to ensure the success of the following command? C:\> notepad helloworld.txt:goodbye.txt

The correct answer is C. An NTFS partition. The given command shows an alternate data stream being added to the helloworld.txt file. File streaming is supported on NTFS, which allows alternative data streams to be associated with a file; the alternate (read: secondary and thereafter) stream(s) are hidden from view when vie

Malware Analysis & Advanced Persistent Threats

Question

Which is a requirement to ensure the success of the following command? C:> notepad helloworld.txt:goodbye.txt

Options

  • AReplace notepad with more
  • BEncryption must be disabled on the drive
  • CAn NTFS partition
  • DInstallation of a 3 party tool rd

How the community answered

(62 responses)
  • A
    3% (2)
  • B
    5% (3)
  • C
    90% (56)
  • D
    2% (1)

Explanation

The given command shows an alternate data stream being added to the helloworld.txt file. File streaming is supported on NTFS, which allows alternative data streams to be associated with a file; the alternate (read: secondary and thereafter) stream(s) are hidden from view when viewing files normally via Windows Explorer or the command line.

Topics

#NTFS alternate data streams#Windows filesystem#ADS steganography

Community Discussion

No community discussion yet for this question.

Full GCIH Practice