CHFI Storage Forensics and File System Analysis Practice Question
An examiner is analyzing an NTFS volume and suspects that a suspect hid data using Alternate Data Streams (ADS). Which tool or method is MOST appropriate to list all ADS on the volume?
⚠ Common exam trap
The CHFI exam often tests the misconception that Linux tools like 'ls -la' can universally detect NTFS-specific features, but candidates must remember that ADS are a Windows/NTFS construct requiring native Windows commands or specialized forensic tools.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Execute 'dir /r' in a Windows command prompt on the mounted image
The 'dir /r' command in Windows Command Prompt is specifically designed to display alternate data streams (ADS) on NTFS volumes. It lists all files and directories, including any hidden streams attached to them, making it the most direct and appropriate method for an examiner to enumerate all ADS on a mounted NTFS volume.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Execute 'dir /r' in a Windows command prompt on the mounted image
Why this is correct
The 'dir /r' command is a built-in Windows utility that enumerates alternate data streams (ADS) on NTFS volumes. When run against a mounted forensic image or drive, it displays each file accompanied by any named streams in the format 'file.txt:streamname:$DATA'. This directly queries the NTFS $ATTRIBUTE_LIST and $DATA attributes through the Windows filesystem driver, making it the simplest standard technique to confirm the presence and names of hidden ADS.
- ✗
Run 'ls -la' from a Linux forensic environment
Why it's wrong here
The Linux 'ls -la' command only lists directory entries and regular file metadata; it does not natively enumerate NTFS alternate data streams. The in-kernel NTFS driver typically exposes only the unnamed $DATA stream and ignores named streams, and even ntfs-3g requires the 'streams_xattr' mount option to map ADS to extended attributes. Without that special option, 'ls -la' produces no indication of stream existence, so it would miss the very artifact being investigated.
- ✗
Use 'icacls' to view security descriptors and detect ADS
Why it's wrong here
icacls is designed to display and modify discretionary access control lists (DACLs) and security descriptors, not filesystem data streams. Alternate data streams are separate named $DATA attributes, whereas ACLs are stored in the $SECURITY attribute of the MFT; the two are entirely independent metadata. Running icacls against a file would reveal its permission entries and ownership, but it provides no output related to named streams and cannot detect their presence.
- ✗
Mount the image in Autopsy and run the 'Find File' module
Why it's wrong here
Autopsy's 'Find File' module is primarily a filename-based search interface and is not the dedicated mechanism for exposing alternate data streams. While Autopsy as a whole can parse NTFS and may display named streams as separate artifacts (often denoted with ':$DATA' or via forensic ingest modules like ExifTool), simply invoking 'Find File' will not surface streams unless the ingestion already cataloged them. The correct Autopsy approach would involve the 'File Search' or the raw file tree/metadata view, not this specific module.
Go deeper
Related to this question
About these practice questions
One of 205 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.