CHFI Storage Forensics and File System Analysis Practice Question
During a forensic examination of an NTFS drive, an investigator finds that a file 'notes.txt' has an additional data stream named 'hidden.txt' attached. Which feature of NTFS allows this?
⚠ Common exam trap
Test-takers frequently confuse ADS with slack space or the MFT, thinking that any hidden data in NTFS must be in slack space or metadata, when ADS is the specific feature for named additional streams.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Alternate Data Streams (ADS)
C is correct because NTFS supports Alternate Data Streams (ADS), a feature that allows multiple data streams to be associated with a single file. The 'hidden.txt' stream attached to 'notes.txt' is a classic example of ADS, which can be used to hide data or store metadata without affecting the file's primary content.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
USN Journal
Why it's wrong here
The USN Journal is an NTFS change journal that records the sequence of file system changes, logging entries for creations, deletions, metadata modifications, and data overwrites. It is a forensic timeline artifact that can reveal when a file was altered to hide data, but it is not a storage mechanism for the hidden content itself. ADS data would be referenced by journal entries, but the actual hidden bytes reside in an NTFS data stream, not in the journal.
- ✗
MFT
Why it's wrong here
The Master File Table is the central catalog of every file and directory on an NTFS volume, storing metadata attributes such as timestamps, security descriptors, and the locations of data attributes. While very small resident files can have their primary data stored directly inside the MFT record, this is distinct from Alternate Data Streams, which are separate $DATA attributes attached to a file record. The MFT can show the names and sizes of streams, but it is not the hiding medium; it is the index that points to the streams.
- ✓
Alternate Data Streams (ADS)
Why this is correct
Alternate Data Streams (ADS) is a native NTFS capability that allows multiple data streams to be associated with a single file or directory, each identified by a name after a colon (e.g., file.txt:hidden.txt). Data written to an ADS is not shown by typical file size listings or directory views, yet it consumes logical disk space and can contain executables or other arbitrary content. Forensic tools such as `streams` or PowerShell's `Get-Item -Stream *` are required to enumerate and recover ADS, and the Zone.Identifier stream is a legitimate example, while attackers exploit this feature for stealth.
- ✗
Slack space
Why it's wrong here
Slack space refers to the unused bytes between the end of a file's actual data and the end of the final cluster allocated to that file, resulting from cluster-granularity storage. Although slack space can be used to conceal data by writing to these residual bytes, it is not a named stream and is not visible in the file system's logical metadata. Unlike ADS, which is a structured attribute with a filename, slack space is an artifact of physical disk allocation and is only discovered through raw disk imaging and carving.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 745 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.