CHFI Storage Forensics and File System Analysis Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  dir /s

  Why it's wrong here

  The /s switch recursively lists files and folders in the current directory and all subdirectories, but it only shows the primary data stream of each file. Windows' standard file enumeration does not make any calls to the NTFS API functions that retrieve stream-level information. As a result, a recursive listing would still miss alternate data streams because they are not considered part of the directory entry structure. The /s switch simply extends the same attribute-limited listing to deeper levels of the tree.

• ✗

  dir /x

  Why it's wrong here

  The /x switch is used to display the short (8.3) file name generated by Windows for compatibility with legacy software, in addition to the long file name. This short name is a separate naming alias, not a separate data stream; it points to the same primary stream. Alternate data streams are identified by a colon delimiter and are accessed as separate named components of the file, so no amount of name expansion will reveal them. /x therefore has no effect on stream enumeration and cannot expose hidden data.

• ✓

  dir /r

  Why this is correct

  The /r switch, introduced in Windows Vista, explicitly instructs dir to enumerate all alternate data streams associated with each file. For every file that has an ADS, the output includes an additional line in the format 'filename:streamname:$DATA', which is the standard NTFS stream representation. This switch directly queries the NTFS stream list, so it can disclose data that was hidden by writing bytes to a named stream. Given the investigation involves hidden data via alternate streams, /r is the correct command-line option.

• ✗

  dir /a

  Why it's wrong here

  The /a switch controls which files are displayed based on their file attribute flags, such as hidden, system, archive, or read-only. It does not request any stream-level information from the file system; the output still only reflects the primary data stream and the file's attributes. Even when /a reveals hidden files, the hidden attribute only governs the visibility of the file name, not the existence of alternate streams inside that file. Thus /a can assist in finding files with hidden attributes, but it will never show stream data or reveal steganographically hidden content.

Go deeper

Related to this question