CHFI Storage Forensics and File System Analysis Practice Question
An analyst suspects that sensitive data was hidden in the NTFS Alternate Data Streams (ADS) of a file on a suspect's drive. Which tool is specifically designed to enumerate and extract data from ADS on a live Windows system?
⚠ Common exam trap
EC-Council CHFI often tests the distinction between file carving tools (Foremost, PhotoRec) and tools that parse file system metadata (Streams.exe), leading candidates to mistakenly choose a carving tool for ADS enumeration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Streams.exe (Sysinternals)
Streams.exe from Sysinternals is specifically designed to enumerate and extract data from NTFS Alternate Data Streams (ADS) on a live Windows system. It scans files and directories for hidden streams, displaying their names and sizes, and can optionally delete or extract them. This makes it the correct tool for the analyst's task.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Foremost
Why it's wrong here
Foremost is a forensic data carving tool that recovers deleted files by scanning raw disk images for file signatures (headers and footers). It does not parse the NTFS master file table, so it cannot enumerate or extract data hidden in NTFS Alternate Data Streams (ADS), which are attached to a file's directory entry rather than existing as standalone deleted data. Running Foremost against a volume would miss ADS content entirely because that content is not a carved artifact with a recognizable header, making it the wrong tool for this specific question.
- ✗
PhotoRec
Why it's wrong here
PhotoRec is designed for file carving from unallocated disk space, using signature-based recovery of multimedia and document files, and it works well for fragmented or deleted files. It has no native support for NTFS Alternate Data Streams, and because ADS data is logically tied to a resident file's metadata, PhotoRec's carve-and-rebuild approach cannot associate stream content with its parent file. Thus, although PhotoRec is a general-purpose recovery tool, it is not the correct choice for detecting hidden data in NTFS ADS.
- ✗
dd
Why it's wrong here
dd is a low-level disk imaging and conversion utility that creates raw byte-for-byte copies of storage media, commonly used to preserve evidence as a forensic image. It does not interpret the NTFS filesystem structure, so it cannot list Alternate Data Streams or extract their content; at most, it can only copy the entire disk, leaving the analyst with an image that still requires a filesystem-aware tool to enumerate streams. Using dd here is a prerequisite step in forensic acquisition, not a method for inspecting ADS.
- ✓
Streams.exe (Sysinternals)
Why this is correct
Streams.exe, part of the Sysinternals suite, is the correct tool because it is specifically built to enumerate NTFS Alternate Data Streams, which are hidden metadata streams associated with files (e.g., 'file.txt:hidden.txt'). It scans the NTFS filesystem and displays the full path of each stream, including the stream name and file size, allowing an analyst to identify suspicious data hidden in ADS. This tool directly addresses the scenario of sensitive data concealed in an NTFS ADS, unlike generic carving or imaging utilities.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 745-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.