312-50 Question 148
Single answer▪ Hiding FilesDuring an internal security assessment, you are asked to demonstrate how an attacker could hide a small text file on a Windows workstation without using encryption or installing third-party tools. The goal is to store the file in a way that is less visible to users browsing the file system with standard Windows Explorer settings, while keeping the original host file usable. Which technique best meets this requirement?
- A
Append the text file into an NTFS Alternate Data Stream attached to an existing file, such as report.docx:hidden.txt
- B
Change the file extension from .txt to .dll so Windows treats it as a system file and hides it automatically
- C
Base64-encode the text file and save it with a .b64 extension inside the Documents folder
- D
Compress the file into a ZIP archive and rename the archive to thumbs.db
Show answer and explanation
Correct answer: A
Explanation
The best answer is the NTFS Alternate Data Stream technique because it allows data hiding on NTFS volumes while preserving the apparent usability of the original file. This aligns with real-world attacker tradecraft and with CEH objectives around steganography and file-hiding methods. ADS is a feature of NTFS, not a bug, and can be created or accessed using native Windows capabilities such as command-line redirection or PowerShell. From a defensive perspective, investigators should use tools that enumerate ADS because standard Windows Explorer views do not display them as separate files. Microsoft documentation on NTFS file streams and forensic best practices both support the fact that ADS can conceal data from casual inspection, whereas simple renaming, encoding, or archiving does not provide comparable concealment.
- A. Correct.
Correct. NTFS Alternate Data Streams (ADS) allow data to be associated with an existing file without changing the visible contents of the host file. For example, a file can store hidden content in a stream such as report.docx:hidden.txt. In standard Windows Explorer views, the ADS content is not shown as a separate file, and the original file remains usable. This is a classic file-hiding technique covered in ethical hacking and forensic contexts.
- B. Incorrect.
Incorrect. Changing a file extension from .txt to .dll does not make Windows hide it as a system file. It only changes the filename and may cause confusion or execution errors. Windows visibility is controlled by file attributes and Explorer settings, not by assigning a misleading extension alone.
- C. Incorrect.
Incorrect. Base64 encoding changes the representation of the content, but it does not hide the file in the file system. The resulting .b64 file is still a normal visible file and is easily discoverable by users or defenders. This option reflects a common misconception that encoding is equivalent to concealment.
- D. Incorrect.
Incorrect. Renaming a ZIP archive to thumbs.db may make it look less suspicious at a glance, but it remains a normal visible file and does not preserve the behavior of a legitimate host file in the same way ADS does. It is simple masquerading, not effective file hiding within the NTFS file system.