312-50 Question 150
Single answer▪ Hiding FilesDuring an internal security assessment, you obtain limited user-level access to a Windows 10 workstation used by a finance employee. You need to store a small text file containing collected host details on disk in a way that is less likely to be noticed by the user during normal file browsing, while avoiding actions that require administrator privileges or specialized third-party tools. Which technique is the most appropriate?
- A
Hide the data inside an NTFS Alternate Data Stream attached to an existing benign file, such as notes.txt:inventory.log
- B
Mark the file as a system boot file using bcdedit so File Explorer will not display it
- C
Convert the entire user profile directory to an encrypted volume so the text file is concealed from the user
- D
Store the file in the Windows Registry under HKLM\SAM because standard users can write there without detection
Show answer and explanation
Correct answer: A
Explanation
The best answer is the use of an NTFS Alternate Data Stream (ADS). In real-world Windows environments, ADS is a known method for hiding small amounts of data within NTFS files without changing the normal visible filename. This aligns with the scenario constraints: limited user privileges, no third-party tools, and a need for low-visibility file storage. CEH candidates should recognize that ADS is practical for concealment but not foolproof; defenders can detect it with appropriate tools such as PowerShell stream enumeration or Sysinternals utilities. Microsoft documents NTFS file streams as part of Windows file system behavior, and security best practices emphasize inspecting hidden streams during forensic analysis and threat hunting.
- A. Correct.
Correct. On NTFS volumes, Alternate Data Streams (ADS) allow data to be attached to an existing file without changing what a user typically sees in File Explorer. For example, a stream such as notes.txt:inventory.log can hold hidden content while the visible file still appears normal. This is a classic file-hiding technique discussed in Windows and CEH contexts. It does not inherently require administrator privileges, although access still depends on the current user's permissions to the host file and directory.
- B. Incorrect.
Incorrect. bcdedit is used to manage Boot Configuration Data, not to mark arbitrary user files as hidden from browsing. It generally requires elevated privileges and is unrelated to concealing a text file in a user's profile. This distractor targets the misconception that any Windows system utility can be repurposed for file hiding.
- C. Incorrect.
Incorrect. Converting a profile directory into an encrypted volume is not a realistic or appropriate method in this scenario. It would require significant system changes, likely elevated privileges, and would be disruptive and highly noticeable. Encryption and hiding are different objectives; encryption protects confidentiality, while the question asks for a low-visibility storage method under user-level access.
- D. Incorrect.
Incorrect. HKLM\SAM is a protected registry area associated with local account security data. Standard users cannot write there, and it is not a practical place to store arbitrary text content for stealth. This option reflects a common misunderstanding that sensitive or obscure registry locations are writable and suitable for covert storage by low-privileged users.