Mark is moving files from a device that is formatted using NTFS to a device that is formatted using FAT. Which of the following is he trying to get rid of?

Mark is moving files from a device that is formatted using NTFS to a device that is formatted using FAT. Which of the following is he trying to get rid of?

• A. Hidden file attributes
• B. Malicious alternate data streams.
• C. Journaling
• D. Permission sets

Answer: (B)

Alternate Data Streams are a feature of NTFS that let a file hold additional data in separate streams, often used to hide information inside a file without changing its visible content. FAT doesn’t support these extra streams, so when you move files from NTFS to a FAT-formatted device, those hidden streams aren’t carried over. In effect, you’re eliminating covert data stored in ADS by moving to a file system that doesn’t support it. Hidden file attributes can exist on both NTFS and FAT, so they aren’t uniquely removed by such a move. Journaling is a NTFS feature for tracking changes and recoverability, which FAT doesn’t implement, but the specific hiding mechanic NTFS provides—alternate data streams—disappears on FAT, making it the reason you’d be able to get rid of hidden content tucked away in that way. Permission sets (NTFS ACLs) are also not preserved on FAT, but the cleansed, hidden data aspect points most directly to ADS.

Alternate Data Streams are a feature of NTFS that let a file hold additional data in separate streams, often used to hide information inside a file without changing its visible content. FAT doesn’t support these extra streams, so when you move files from NTFS to a FAT-formatted device, those hidden streams aren’t carried over. In effect, you’re eliminating covert data stored in ADS by moving to a file system that doesn’t support it.

Hidden file attributes can exist on both NTFS and FAT, so they aren’t uniquely removed by such a move. Journaling is a NTFS feature for tracking changes and recoverability, which FAT doesn’t implement, but the specific hiding mechanic NTFS provides—alternate data streams—disappears on FAT, making it the reason you’d be able to get rid of hidden content tucked away in that way. Permission sets (NTFS ACLs) are also not preserved on FAT, but the cleansed, hidden data aspect points most directly to ADS.