File deletion is a way of removing a file from a computer's file system. What happens when a file is deleted in windows7?

Question

Options

• AThe last letter of a file name is replaced by a hex byte code E5h
• BThe operating system marks the file's name in the MFT with a special character that indicates that
• CCorresponding clusters in FAT are marked as used
• DThe computer looks at the clusters occupied by that file and does not avails space to store a new

• A
  2% (1)
• B
  94% (60)
• C
  5% (3)

Explanation

Windows 7 uses the NTFS file system, which maintains the Master File Table (MFT) - a database that stores metadata for every file. When a file is deleted, Windows does NOT immediately erase the data. Instead, it marks the file's MFT entry with a deletion flag (specifically, the record's allocation status is set to 'not in use'), making the space available for future writes while the actual data remains on disk until overwritten. Option A (replacing filename with E5h) describes FAT file system behavior (used in older DOS/Windows systems). Options C and D are incorrect descriptions of NTFS deletion behavior. This MFT marking is why deleted files can often be recovered with forensic tools.

No community discussion yet for this question.