Another NTFS element that may have forensic implications is the presence of alternate data streams (ADS). ADS allows...
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
a file to be associated with more than one data batches on the disk (though the data in a file's ADS will be lost if it's moved to a non-NTFS volume). ADSes cannot be detected by a simple DIR command; they have to be revealed using specialized software.
To learn more about the potentially forensic implications, check out Microsoft's description of how NTFS works.
Dig Deeper on Windows Server and Network Security
Related Q&A from Serdar Yegulalp
This week, our expert answers the question of how to get DVD data off a disc, even if the user's PC doesn't have an optical drive.continue reading
This week, our expert answers a question on how to connect a phone or tablet to a USB drive with a micro-USB connector.continue reading
Open source and free suites such as LibreOffice and OpenOffice could save organizations money, but not effort in comparison with Microsoft Office.continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.