Native NTFS Data Hiding Methods: ADS and Slack Space
Which TWO of the following are valid methods to hide data on an NTFS file system without using external tools?
Quick Answer
The answer is Alternate Data Streams (ADS) and slack space. These are the two valid methods to hide data on an NTFS file system without using external tools because both are native NTFS features that exploit the file system’s own structure. ADS allows data to be appended to a file as a hidden stream, invisible to standard directory listings, while slack space uses the unused bytes between the end of a file and the end of its allocated cluster. On the Computer Hacking Forensic Investigator CHFI exam, this question tests your understanding of file system forensics and anti-forensics, often appearing as a trap where candidates might mistakenly choose third-party tools or encryption. A common memory tip is to remember that both methods are “free” and “built-in”—no downloads needed, just the file system itself. Think of ADS as a secret pocket on a file and slack space as the empty padding in a box; both are invisible unless you specifically look for them.
⚠ Common exam trap
EC-CHFI often tests the misconception that NTFS journals or MFT attributes can be used for data hiding without external tools, but only slack space and Alternate Data Streams (ADS) are native, supported mechanisms that do not require third-party utilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Embedding data in file slack space
A is correct because file slack space is the unused bytes between the end of a file's logical data and the end of its allocated cluster. On NTFS, when a file does not fill its last cluster, the remaining bytes (RAM slack and drive slack) can be written to without affecting the file's visible content. This is a native hiding method that requires no external tools, as the data is simply written to the slack region using standard file I/O operations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Embedding data in file slack space
Why this is correct
File slack is unused space at the end of a cluster that can be filled with data.
- ✗
Storing data in the NTFS file system journal ($LogFile)
Why it's wrong here
The journal is not designed for data hiding; it logs transactions.
- ✗
Using the $Volume attribute in the MFT
Why it's wrong here
$Volume is a system attribute, not for data hiding.
- ✗
Encrypting data with EFS
Why it's wrong here
EFS encrypts, but does not hide existence of data.
- ✓
Using Alternate Data Streams (ADS)
Why this is correct
ADS can hide data in streams attached to files.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CHFI
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are methods used to hide data within the NTFS file system?
medium- A.USN Journal
- ✓ B.File slack space
- C.Volume Shadow Copy
- ✓ D.Alternate Data Streams (ADS)
- E.Encrypting File System (EFS)
Why B: File slack space (B) is correct because it refers to the unused space between the end of a file's data and the end of the allocated cluster, allowing data hiding without affecting file size. Alternate Data Streams (ADS) (D) is correct because it allows multiple data streams to be attached to a file, enabling hidden data to be stored in additional streams. Both techniques are commonly used for data hiding in NTFS.
Variation 2. Which TWO of the following are valid methods for hiding data on an NTFS volume without using third-party tools? (Select 2)
medium- A.Creating a symbolic link to a hidden file
- B.Encrypting the file with EFS
- ✓ C.Slack space (file slack or volume slack)
- ✓ D.Alternate Data Streams (ADS)
- E.Using the $Recycle.bin folder
Why C: Slack space (file slack or volume slack) is a valid method for hiding data on an NTFS volume without third-party tools because it exploits unused bytes between the end of a file's logical data and the end of the allocated cluster (file slack) or between the end of the volume's logical structure and the physical end of the partition (volume slack). This space is not normally visible to the operating system or standard directory listings, making it a native hiding technique.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.