In: Computer Science
1. Define NTFS alternate data stream( 1 Marks).
What is the Significance of whole disk encryption and challenges it poses in digital forensics investigations?Total
Answer)
The file attributes which are found on the NTFS file system are otherwise called as Alternate Data Stream or ADS
This has many attributes wherein $Data is one such attribute which has a regular data stream of the text file and it contains the text inside the text file which is the primary data stream.
This is mostly called the unnamed data stream as the name string of the attribute is empty and the data stream which has the name is considered an alternate.
The significance of FDE or the whole disk encryption is that it would help in encrypting the data present in the disk drive which would have the programs that can encrypt the OS partition. This is done by performing the disk encryption of the software or the hardware which has been installed to the drive while the manufacturing or with regards to the additional software driver. This helps in converting the device data as a form for understanding the key to decrypt the encrypted data. This helps in preventing any unauthorized data access.
The challenges associated with it in digital forensic investigations are as follows:
Hope this answer helps.
If you find this answer useful, do hit like.
Thanks