CHFI Chapter 5 Questions with 100% Verified Solutions

When a FAT File is deleted - The OS replaces the first letter of the deleted filename with E5H. Corresponding clusters of that file are marked unused, even though they are not empty. Until these clusters are overwritten, the file can still be recovered. When a NTFS File is deleted - The OS marks the index field in the MFT with a special code. The computer now looks at the clusters occupied by that file as being empty. Until these clusters are overwritten, the file can be recovered Recycle Bin - A place to store files that are marked for deletion. The exceptions are large files and files from removable media. Windows 98 and earlier (FAT) Recycle Bin - - C:Recycled (4GB limit) - Files are named D o x is drive o y is sequence number (0-??) o ext is original extension. - For the first document file deleted on C: drive would be: D Windows 2000, XP, NT (NTFS) Recycle Bin - C:RecyclerS- (based on windows SID) Windows Vista, 7,8, and 10 Recycle Bin - - C:$Recycle.Bin