GCIH · Question #705
What is an alternate data stream?
The correct answer is A. A file stream on an NTFS partition. An Alternate Data Stream is an NTFS feature that allows a file to contain multiple named data streams beyond its default unnamed primary stream.
Question
What is an alternate data stream?
Options
- AA file stream on an NTFS partition
- BEncoded text within an image file
- CThe Volume Shadow Copy version of a file
- DA secondary file stream on a FAT partition
How the community answered
(40 responses)- A90% (36)
- B3% (1)
- C5% (2)
- D3% (1)
Why each option
An Alternate Data Stream is an NTFS feature that allows a file to contain multiple named data streams beyond its default unnamed primary stream.
ADS is built into the NTFS file system architecture, allowing additional named streams to be appended to any file or directory using the syntax filename:streamname. The primary unnamed stream holds the standard file data, while named streams can store additional hidden content. This feature is specific to NTFS and is not available on FAT-based file systems.
Encoding text within an image file describes steganography, which is a distinct technique for concealing data within image file structures.
A Volume Shadow Copy is a point-in-time snapshot of a volume used for backup and recovery purposes, not a secondary file data stream.
ADS is exclusive to NTFS - FAT and FAT32 partitions do not support the multiple named data stream architecture that ADS requires.
Concept tested: NTFS Alternate Data Streams definition and file system scope
Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/a82e9105-2405-4e37-b2c3-28c773902d85
Topics
Community Discussion
No community discussion yet for this question.