Question #1. Would there be any benefit in hiding a file in the registry versus an alternate data stream? Would the type of file or file size affect your decision? What might prevent you from being able to hide data in this manner?

Question #2.In this weeks reading we learned of ways to hide data in Windows and Linux by deleting a file and then recovering it. In Windows this was accomplished using VSSADMIN and in Linux this was accomplished by using E2undel. Knowing this, how could you apply what you have learned to hide or recover data on a windows system using Volume Shadow Copies? What about a Linux based system? What type of scenarios can you imagine where this might be useful for an investigator.