Which Item Is Not Part of an NTFS EFS DDF?
NTFS sets a flag for the file once you encrypt it and creates an EFS attribute where it stores Data Decryption Field (DDF) and Data Recovery Field (DDR). Which of the following is not a part of DDF?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests your knowledge of the exact contents of an EFS Data Decryption Field, and the trap is assuming any integrity-related value such as a checksum must belong to the DDF when it actually belongs to the EFS header.
NTFS Encrypting File System (EFS) stores a Data Decryption Field (DDF) inside the $EFS attribute of an encrypted file, holding the per-user material needed to recover the File Encryption Key (FEK). This page establishes that the DDF contains the encrypted FEK, the EFS certificate hash, the user SID, container and provider names — but not the checksum, which lives in the encrypted file's header rather than the DDF.
Choosing B is correct here; the common mistake is answering A, C, or D by treating the encrypted FEK, certificate hash, or container name as extraneous — all three are genuine DDF components, and only the checksum is stored elsewhere (in the EFS header), as jingu_bingo cited from CHFIv11 page 245.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The DDF is the per-user record that lets an authorized user decrypt the File Encryption Key, so it must carry the cryptographic and identity material needed for that recovery: the encrypted FEK itself, the EFS certificate hash that identifies the user's certificate, plus the user SID, container name, and provider name. A checksum is an integrity value applied to the encrypted file's data/header region, not to the DDF record, so it is not part of the DDF. This matches the answer key and the CHFIv11 text cited by jingu_bingo on page 245, which states the checksum sits in the header rather than the DDF.Why the Other Options Are Wrong
Option A, the encrypted FEK, is the core payload of the DDF — without it no holder of the private key could recover the file's encryption key. Option C, the EFS certificate hash, links the DDF entry to the specific certificate whose private key unwraps the FEK, so it is required. Option D, the container name (along with the provider name), identifies the cryptographic provider context for decryption and is likewise enumerated as a DDF component. Each of these is therefore a legitimate part of the DDF, leaving the checksum as the only non-member.Community Comment Notes
All recorded learner votes selected B, and jingu_bingo reinforced this by pointing to "CHFIv11 page 245. checksum is included in the Header, NOT the DDF." By contrast, aqeel1506's comment lists the checksum as if it were included and asserts that "Container Name is not part of the Data Decryption Field (DDF)," which contradicts the official DDF layout; Elb's list corroborates the correct view, enumerating "User SID Container Name Provider Name EFS Certificate Hash Encrypted FEK" as the DDF contents.Exam Strategy
When a question asks which item is NOT part of a structure, first enumerate everything that genuinely belongs to it, then identify the orphan — here the checksum belongs to the EFS header, not the DDF. Memorize the DDF set (SID, container name, provider name, certificate hash, encrypted FEK) since EFS internals are frequently tested in CHFI.
Frequently Asked Questions
Why is the checksum excluded from the EFS Data Decryption Field?
The checksum protects the integrity of the encrypted file's header/data region, so it is stored in the EFS header rather than in the per-user DDF record inside the $EFS attribute.
What does the DDF actually contain in an NTFS EFS attribute?
The DDF stores the user SID, container name, provider name, EFS certificate hash, and the FEK encrypted to the user's public key, enabling key recovery via the private key.