GPEN · Question #201
Adam, a malicious hacker, hides a hacking tool from a system administrator of his company by using Alternate Data Streams (ADS) feature. Which of the following statements is true in context with the a
The correct answer is A. Adam is using NTFS file system.. Alternate Data Streams (ADS) is a feature exclusive to the NTFS file system on Windows, allowing data to be hidden within file stream forks invisible to standard directory listings.
Question
Adam, a malicious hacker, hides a hacking tool from a system administrator of his company by using Alternate Data Streams (ADS) feature. Which of the following statements is true in context with the above scenario?
Options
- AAdam is using NTFS file system.
- BAlternate Data Streams is a feature of Linux operating system.
- CAdam is using FAT file system.
- DAdam's system runs on Microsoft Windows 98 operating system.
How the community answered
(48 responses)- A77% (37)
- B13% (6)
- C2% (1)
- D8% (4)
Why each option
Alternate Data Streams (ADS) is a feature exclusive to the NTFS file system on Windows, allowing data to be hidden within file stream forks invisible to standard directory listings.
ADS is an attribute of the NTFS file system, which allows multiple data streams to be attached to a single file. Because ADS streams do not appear in standard directory listings, they are commonly exploited to hide malicious tools or data. FAT and other file systems do not support this feature.
ADS is a Windows NTFS feature, not a Linux file system feature; Linux uses ext-family and other file systems that do not implement data streams in this manner.
The FAT file system does not support Alternate Data Streams; ADS is specific to NTFS.
Windows 98 used the FAT32 file system by default, which does not support NTFS features such as ADS.
Concept tested: NTFS Alternate Data Streams for data hiding
Source: https://learn.microsoft.com/en-us/sysinternals/downloads/streams
Topics
Community Discussion
No community discussion yet for this question.