CHFI Storage Forensics and File System Analysis Practice Question
During a forensic analysis of an NTFS volume, an investigator finds a file that appears to be hidden. Which NTFS feature allows data to be stored in a file without affecting the file's visible size in the directory listing?
⚠ Common exam trap
The CHFI exam often tests the misconception that the Master File Table ($MFT) is the primary location for hiding data, but the trap here is that ADS directly allows data to be stored in a file without changing its visible size, while $MFT manipulation (e.g., slack space) is a different, more complex technique.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Alternate Data Streams (ADS)
Alternate Data Streams (ADS) allow additional data to be attached to a file on an NTFS volume without altering the file's main data stream or its visible size in directory listings. This is possible because NTFS organizes file data into multiple streams; the default $DATA stream holds the visible content, while additional named streams can store hidden data. Tools like `dir` or Windows Explorer only report the size of the unnamed $DATA stream, making ADS an effective method for concealing data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Alternate Data Streams (ADS)
Why this is correct
Alternate Data Streams (ADS) are a legitimate NTFS feature that allow additional named data streams to be attached to a file, accessible via the syntax file.txt:stream. Because standard directory listings and file properties typically report only the primary unnamed stream, an investigator using conventional utilities may completely miss malicious payloads hidden in ADS. Forensic examiners must explicitly enumerate streams using specialized tools (e.g., streams.exe, lads, or forensic suites) and inspect the $MFT attribute list to identify these hidden data regions, as they are a classic anti-forensic hiding technique.
- ✗
Volume Shadow Copy
Why it's wrong here
Volume Shadow Copy (VSS) is a Windows service that creates point-in-time snapshots of entire volumes, primarily used for system restore and backups. It does not exist as a per-file data hiding mechanism; rather, it maintains historical versions of files through a separate system-level storage area (the shadow storage) managed by the Volume Shadow Copy Service. While shadow copies can contain residual evidence from previous versions of files, they are not a feature designed to attach hidden content to a specific file, so they are not semantically equivalent to ADS.
- ✗
USN Journal
Why it's wrong here
The USN Journal (Update Sequence Number Journal) is an NTFS change journal that records metadata about modifications to files and directories, such as creation, deletion, and attribute changes, but it never stores the actual content of files. It is a log that an investigator can parse to reconstruct file system activity and timelines, making it a valuable source of forensic evidence about when changes occurred. However, because it only contains change records, not file data, it cannot be used to hide data within a file, unlike ADS.
- ✗
Master File Table ($MFT)
Why it's wrong here
The Master File Table ($MFT) is the core NTFS metadata file that contains one record for every file and directory on the volume, storing attributes such as timestamps, security descriptors, and often the file's data (in resident attributes when small enough). Although an attacker could theoretically abuse $MFT entries to store hidden data, $MFT is a system database, not a user-accessible per-file feature for attaching extra streams. In standard forensic analysis, $MFT provides metadata and content for the file itself, but it is not the mechanism for creating hidden parallel streams, which is the defining characteristic of ADS.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.