CompTIA Exam Prep - ITF+, A+, Network+, Security+, CySA+

Every file on an NTFS volume has at least one data stream — the unnamed one, which is what you see when you open the file. NTFS also permits additional named streams attached to the same file. Their contents do not appear when the file is opened, do not affect the size shown in Explorer, and survive an ordinary copy within NTFS. That combination makes alternate data streams a durable hiding place, and knowing they exist is the difference between finding data during an investigation and missing it entirely. How They Work The syntax is a colon: filename.txt:hidden refers to a stream named hidden on the file filename.txt . Reading filename.txt returns only the default stream. The named stream is reachable only by asking for it specifically. Consequences that matter in practice: Explorer shows the default stream's size. A one-kilobyte text file can carry a fifty-megabyte alternate stream and still look like a one-kilobyte text file. Disk free space changes; the file...

exFAT was created to solve one specific problem: FAT32 cannot store a file larger than 4 GB, and by the time high-definition video and large disk images became ordinary, that limit had become intolerable on removable media. The obvious alternative was NTFS, but NTFS carries permissions, journaling and Windows-specific metadata that make it a poor fit for a memory card moving between a camera, a phone and a laptop. exFAT is the middle option: modern capacity limits, minimal overhead, broad compatibility. The Three, Compared FAT32 — maximum file size 4 GB minus one byte, maximum volume size 2 TB in practice (32 GB when formatting through the Windows GUI). Universally readable by essentially every device ever made. No permissions, no journaling, no encryption. Covered further in FAT32 . exFAT — file and volume limits so large they are irrelevant in practice (128 PB). Supported by Windows, macOS, modern Linux, Android and most cameras. Larger cluster sizes suited to bi...