Exam 312-49v10 topic 1 question 643 discussion

Stream Detector is a forensic tool that identifies all hidden files such as images, videos, text, and executables within Alternate Data Streams present on NTFS drives It can detect the hidden streams on actual file directory and lists hidden stream file name, stream type, size of the stream, etc. This tool can be used to detect and extract hidden streams, delete the file and unwanted streams.

https://www.appsvoid.com/products/stream-detector/

D < https://www.appsvoid.com/products/stream-detector/ "This tool can be used to find and delete hidden alternate data streams used by malware and rootkits, such...."

C. analyzeMFT The forensic tool "analyzeMFT" allows investigators to detect and extract hidden streams on NTFS (New Technology File System) drives. Hidden streams are a feature of NTFS that allows data to be associated with a file without being immediately visible in the regular file system. Analyzing the Master File Table (MFT) can reveal information about these hidden streams and their associated files. Option A (Autopsy) is an open-source digital forensics platform primarily used for analyzing disk images and file systems. Option B (TimeStomp) is a tool used to manipulate file timestamps, not specifically for detecting hidden streams. Option D ("Stream Detector") is not a recognized tool in the context of forensic analysis.