Which Item Is Not Part of an NTFS EFS DDF?
Short answer
B The checksum is not part of the EFS Data Decryption Field; DDF holds the encrypted FEK, EFS certificate hash, user SID, container name and provider name.
Question
Key Takeaways
The question tests your knowledge of the exact contents of an EFS Data Decryption Field, and the trap is assuming any integrity-related value such as a checksum must belong to the DDF when it actually belongs to the EFS header.
NTFS Encrypting File System (EFS) stores a Data Decryption Field (DDF) inside the $EFS attribute of an encrypted file, holding the per-user material needed to recover the File Encryption Key (FEK). This page establishes that the DDF contains the encrypted FEK, the EFS certificate hash, the user SID, container and provider names — but not the checksum, which lives in the encrypted file's header rather than the DDF.
Common mistake: Choosing B is correct here; the common mistake is answering A, C, or D by treating the encrypted FEK, certificate hash, or container name as extraneous — all three are genuine DDF components, and only the checksum is stored elsewhere (in the EFS header), as jingu_bingo cited from CHFIv11 page 245.
Expert Analysis
Why the Answer Is Correct
The DDF is the per-user record that lets an authorized user decrypt the File Encryption Key, so it must carry the cryptographic and identity material needed for that recovery: the encrypted FEK itself, the EFS certificate hash that identifies the user's certificate, plus the user SID, container name, and provider name. A checksum is an integrity value applied to the encrypted file's data/header region, not to the DDF record, so it is not part of the DDF. This matches the answer key and the CHFIv11 text cited by jingu_bingo on page 245, which states the checksum sits in the header rather than the DDF.
Why the Other Options Are Wrong
Option A, the encrypted FEK, is the core payload of the DDF — without it no holder of the private key could recover the file's encryption key. Option C, the EFS certificate hash, links the DDF entry to the specific certificate whose private key unwraps the FEK, so it is required. Option D, the container name (along with the provider name), identifies the cryptographic provider context for decryption and is likewise enumerated as a DDF component. Each of these is therefore a legitimate part of the DDF, leaving the checksum as the only non-member.
Community Comment Notes
All recorded learner votes selected B, and jingu_bingo reinforced this by pointing to "CHFIv11 page 245. checksum is included in the Header, NOT the DDF." By contrast, aqeel1506's comment lists the checksum as if it were included and asserts that "Container Name is not part of the Data Decryption Field (DDF)," which contradicts the official DDF layout; Elb's list corroborates the correct view, enumerating "User SID Container Name Provider Name EFS Certificate Hash Encrypted FEK" as the DDF contents.
Exam Strategy
When a question asks which item is NOT part of a structure, first enumerate everything that genuinely belongs to it, then identify the orphan — here the checksum belongs to the EFS header, not the DDF. Memorize the DDF set (SID, container name, provider name, certificate hash, encrypted FEK) since EFS internals are frequently tested in CHFI.
Frequently Asked Questions
Why is the checksum excluded from the EFS Data Decryption Field?
What does the DDF actually contain in an NTFS EFS attribute?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
aqeel1506 👍 1In the context of NTFS and EFS (Encrypting File System), the Data Decryption Field (DDF) includes: Encrypted FEK: The File Encryption Key used to encrypt the file data. Checksum: Used for verifying the integrity of the encrypted data. EFS Certificate Hash: Part of the cryptographic information used to decrypt the file. Container Name is not part of the Data Decryption Field (DDF). It is not included in the EFS attributes related to encryption and decryption directly. so the answer is D container name
-
Elb 👍 1B > The DDF contains: User SID Container Name Provider Name EFS Certificate Hash Encrypted FEK
-
jingu_bingo 👍 1 Answered BCHFIv11 page 245. checksum is included in the Header, NOT the DDF.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.