CHFI Chapter 5-6

CHFI Chapter 5-6 Questions with 100% Verified Solutions Windows: When a user deletes a file, the OS does not actually delete the file, it - marks the file name in the Master File Table (MFT) with a special character. This character represents that the space once occupied by the file is ready for use FAT - The OS replaces the first letter of the deleted filename with - E5H, Corresponding clusters of that file are marked unused, even though they are not empty. Until these clusters are overwritten, the file can still be recovered Deleted files in NTFS - The OS marks the index field in the MFT with a special code. - The computer now looks at the clusters occupied by that file as being empty. Until these clusters are overwritten, the file can be recovered Recycle Bin - A place to store files that are marked for deletion. The exceptions are large files and files from removable media Setting Windows registry key "HKLMSYSTEMCurrentControlSetControlFileSystemNtfsDisableLastAccessUpdate" to 1 - disables updating of the last-accessed timestamp What Happens When a File is Deleted? Windows 98 and earlier (FAT) - - C:Recycled (4GB limit - Files are named D o x is drive o y is sequence number (0-??) o ext is original extension - For the first document file deleted on C: drive would be: D What Happens When a File is Deleted? Windows 2000, XP, NT (NTFS) - - C:RecyclerS- (based on windows SID) What Happens When a File is Deleted? Windows Vista, 7,8, and 10 - - C:$Recycle.Bin - Files are named $R o y is sequence number o ext is original extension - For the first document file deleted on C: drive would be: $R What Happens When a File is Deleted? When a user deletes a file or folder, the OS stores all the details of the file such as its complete path, including the original file name, - in a special hidden file called "Info" or "Info2" in the Recycle Bin fold