GIAC Certified Incident Handler (GCIH) — Question 169

Which of the following commands will identify hidden file streams within the C:\Documents folder?

Answer options

• A. > c:\tools\lads\lads /S c:\Documents
• B. > eventvwr c:\Documents.
• C. > type c:\Documents | more
• D. > more /r c:\Documents

Correct answer: D

Explanation

The correct answer is D, as the command 'more /r' allows for the display of hidden streams in the specified directory. Option A is incorrect because it is not the appropriate command for this task, while options B and C do not relate to identifying hidden file streams at all.