Question

while examining the $mft record of a photograph of a famous city landmark, an examiner notes that there are two 0x80 attribute records in the $mft record. what is the significance of this finding?
a. by default, there are always two 0x80 attributes in an $mft record.
b. multiple 0x80 attribute fields are used to store each of the metadata properties of the photograph.
c. a second data stream is appended after the first data stream.
d. the $mft record is corrupted or altered and requires repair.

Explanation:

The 0x80 attribute in NTFS $MFT records represents a data stream. A single file can have multiple data streams (alternate data streams). Having two 0x80 attributes indicates an additional data stream attached to the main file stream. Option a is incorrect as default $MFT records do not always have two 0x80 attributes. Option b is wrong because metadata is stored in other dedicated attributes, not 0x80 fields. Option d is incorrect as multiple 0x80 attributes are a valid feature, not a sign of corruption.

Answer:

c. A second data stream is appended after the first data stream.