GCIH · Question #643
Which of the following commands will identify hidden file streams within the C:\Documents folder?
The correct answer is A. > c:\tools\lads\lads /S c:\Documents. NTFS Alternate Data Streams (ADS) can hide data within the file system, and the LADS tool is designed to recursively enumerate these hidden streams that standard directory listings do not reveal.
Question
Which of the following commands will identify hidden file streams within the C:\Documents folder?
Options
- A
c:\tools\lads\lads /S c:\Documents
- B
eventvwr c:\Documents.
- C
type c:\Documents | more
- D
more /r c:\Documents
How the community answered
(23 responses)- A96% (22)
- C4% (1)
Why each option
NTFS Alternate Data Streams (ADS) can hide data within the file system, and the LADS tool is designed to recursively enumerate these hidden streams that standard directory listings do not reveal.
LADS (List Alternate Data Streams) is a forensic utility built specifically to enumerate NTFS alternate data streams, which are hidden data forks that can conceal files or malicious payloads. The /S switch enables recursive scanning of C:\Documents and all subdirectories, surfacing any hidden streams that 'dir' or Explorer would not display.
Event Viewer (eventvwr) displays Windows event logs from the system, security, and application channels and has no ability to inspect NTFS file system metadata or alternate data streams.
The 'type' command outputs the primary data stream of a text file to the console and cannot enumerate or reveal ADS hidden within NTFS file system entries.
'more /r' is not a valid Windows command for listing file streams; the 'more' command is a text pager utility and does not interact with NTFS alternate data stream metadata.
Concept tested: Detecting NTFS alternate data streams with LADS tool
Source: https://learn.microsoft.com/en-us/sysinternals/downloads/streams
Topics
Community Discussion
No community discussion yet for this question.