In NTFS Master File Table, a data stream file corresponds to which descriptor?

In NTFS Master File Table, a data stream file corresponds to which descriptor?

• A. Data stream file
• B. Compressed file
• C. Reserved file
• D. Encrypted file

Answer: (A)

In NTFS, the actual content of a file is described by the data attribute in the Master File Table entry. This $DATA attribute serves as the descriptor for the file’s data stream—the bytes that make up the file. Whether the data is stored resident (inside the MFT) or nonresident (outside on disk), or even if the file is compressed or encrypted, the descriptor that defines the data stream itself remains the data attribute. Additional named data streams would also use $DATA attributes, referenced via an ATTRIBUTE_LIST, but the primary data stream is described by this same descriptor. So the data stream file corresponds to the data attribute descriptor.

In NTFS, the actual content of a file is described by the data attribute in the Master File Table entry. This $DATA attribute serves as the descriptor for the file’s data stream—the bytes that make up the file. Whether the data is stored resident (inside the MFT) or nonresident (outside on disk), or even if the file is compressed or encrypted, the descriptor that defines the data stream itself remains the data attribute. Additional named data streams would also use $DATA attributes, referenced via an ATTRIBUTE_LIST, but the primary data stream is described by this same descriptor. So the data stream file corresponds to the data attribute descriptor.