nerdexam
GIAC

GCIH · Question #628

When copying a file that includes alternate data streams, what happens to the streams during the copying process?

The correct answer is A. They are copied, provided the destination file system is NTFS. NTFS Alternate Data Streams are preserved intact when copying a file to an NTFS destination, but are silently lost if the destination file system does not support them.

Malware Analysis & Advanced Persistent Threats

Question

When copying a file that includes alternate data streams, what happens to the streams during the copying process?

Options

  • AThey are copied, provided the destination file system is NTFS
  • BThey are compressed using the WinZip encryption algorithms
  • CThey are removed and only the original file is moved
  • DAn error message is displayed indicating that data was lost

How the community answered

(47 responses)
  • A
    89% (42)
  • B
    2% (1)
  • C
    6% (3)
  • D
    2% (1)

Why each option

NTFS Alternate Data Streams are preserved intact when copying a file to an NTFS destination, but are silently lost if the destination file system does not support them.

AThey are copied, provided the destination file system is NTFSCorrect

Alternate Data Streams (ADS) are an NTFS-specific feature that allows additional named data streams to be attached to a file alongside its primary content. When copying a file with ADS to another NTFS-formatted volume, Windows preserves all associated streams exactly as-is. If the destination is a non-NTFS file system such as FAT32 or exFAT, the streams are silently dropped without an error or warning.

BThey are compressed using the WinZip encryption algorithms

Windows does not automatically compress or encrypt alternate data streams using WinZip or any other algorithm during a standard file copy operation; streams are either preserved or silently discarded.

CThey are removed and only the original file is moved

Alternate data streams are not universally removed during copying - they are only lost when the destination file system lacks NTFS support, and the primary file data is always copied regardless.

DAn error message is displayed indicating that data was lost

Windows does not generate an error message or warning when alternate data streams are lost during a copy to a non-NTFS destination; the loss occurs completely silently.

Concept tested: NTFS alternate data streams preservation during file copy

Source: https://learn.microsoft.com/en-us/windows/win32/fileio/file-streams

Topics

#NTFS#alternate data streams#file system behavior#data hiding

Community Discussion

No community discussion yet for this question.

Full GCIH Practice