Ace Your Exams with Our Notes and Mock Tests!

EC-Council: Computer Hacking Forensic Investigator(CHFI-V10)
Module 3 : Understanding Hard Disks and File Systems
Questions available : 89		You are not logged in. Please Login for track your learning progress

Q. No: 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 |
		Go to Question No.

Question No 0

---

If you want to share the link of this question, please click here to "Copy Question Link" and share that generated link. Link from URL may change in future.

 

---

Bookmark this Question		QID: 325
NTFS sets a flag for the file once you encrypt it and creates an EFS attribute where it stores Data Decryption Field (DDF) and Data Recovery Field (DDR). Which of the following is not a part of DDF?
A:    EFS Certificate Hash
B:    Container Name
C:    Encrypted FEK
D:    Checksum
Explanation: NTFS sets a flag for a file once you encrypt it and creates an EFS attribute where it stores Data Decryption Field (DDF) and Data Recovery Field (DDR) DDF: User SID, Container Name, Provider Name, EFS certificate hash and Encryption file encryption key (FEK) DRF: The portion of the EFSRPC Metadata that contains information that enables authorized DRAs to decrypt the file.