CHFI Alternate Data Stream (ADS) Practice Question
During a forensic examination of a Windows system, an analyst finds a file that appears to be zero bytes in size when viewed in Windows Explorer, but the file's properties show a size on disk of 4 KB. What is the most likely explanation?
⚠ Common exam trap
Candidates often confuse the discrepancy between logical size and size on disk. They may attribute it to sparse files or compression, but the key clue is a zero-byte logical size with non-zero disk allocation, which is a classic indicator of an alternate data stream.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file is stored in an alternate data stream (ADS)
An alternate data stream (ADS) allows additional data to be stored with a file in NTFS. Windows Explorer typically displays only the size of the main file stream, not the ADS. Therefore, a file with a zero-byte main stream but an ADS containing data will show a logical size of 0 bytes, while the 'size on disk' reflects the allocated clusters for the ADS data (e.g., 4 KB). This is a common technique used to hide data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The file contains only slack space
Why it's wrong here
Slack space is the unwritten residual area between the end of a file's data and the end of its last allocated cluster. A zero-byte file has no data content, so if it did have an allocated cluster (which NTFS normally avoids for empty files), the entire cluster would be slack, not contain meaningful data. Crucially, slack space is a byproduct of writing a shorter file into a previously allocated cluster, not a mechanism that can coexist with a zero logical size and occupied disk space.
- ✗
The file is compressed using NTFS compression
Why it's wrong here
NTFS compression uses LZNT1 or similar algorithms to reduce the number of clusters a file occupies on disk, but it only applies to existing logical data. A file with a logical size of zero has no data to compress, so the compression attribute would be irrelevant; NTFS would still allocate no clusters for the compressed stream. Furthermore, compression reduces allocated size relative to logical size, whereas the scenario shows allocated space exceeding the logical size, so the cause cannot be compression.
- ✓
The file is stored in an alternate data stream (ADS)
Why this is correct
NTFS supports alternate data streams (ADS), which are named data streams attached to a file in addition to the default unnamed stream. The file's logical size, as displayed in Explorer or via standard APIs, reflects only the unnamed main stream, so a file with an empty main stream but data written into a named ADS will show 0 bytes while still consuming allocated clusters on disk for the ADS content. Forensic examiners must enumerate all data streams (e.g., using `dir /R` or specialized tools) to detect hidden data.
- ✗
The file is a sparse file
Why it's wrong here
Sparse files are files that have large logical sizes but allocate clusters only for the portions of data that are explicitly written, with the unwritten ranges treated as zero-filled holes. In a sparse file, the logical size is always greater than or equal to the size on disk, because the holes are counted in the file's logical length but not allocated. A zero-byte sparse file would have no holes and no allocated clusters, so it cannot explain disk space being allocated for what appears to be a zero-length file.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.