Another NTFS element that may have forensic implications is the presence of alternate data streams (ADS). ADS allows a file to be associated with more than one data batches on the disk (though the data in a file's ADS will be lost if it's moved to a non-NTFS volume). ADSes cannot be detected by a simple DIR command; they have to be revealed using specialized software.
To learn more about the potentially forensic implications, check out Microsoft's description of how NTFS works.
Dig Deeper on Windows Server troubleshooting
Related Q&A from Serdar Yegulalp
This week, our expert answers the question of how to get DVD data off a disc, even if the user's PC doesn't have an optical drive. Continue Reading
This week, our expert answers a question on how to connect a phone or tablet to a USB drive with a micro-USB connector. Continue Reading
Open source and free suites such as LibreOffice and OpenOffice could save organizations money, but not effort in comparison with Microsoft Office. Continue Reading