What happens when a file is deleted by a Microsoft operating system using the FAT file system?

The correct answer is D. Only the reference to the file is removed from the FAT and can be recovered. In the FAT (File Allocation Table) file system, file deletion is a logical operation, not a physical one. When a file is deleted, the operating system marks the first character of the file's directory entry with a special character (0xE5) and clears the corresponding FAT chain…

Submitted by anjalisingh· Apr 18, 2026Disk Forensics

Question

Options

AThe file is erased and cannot be recovered
BThe file is erased but can be recovered partially
CA copy of the file is stored and the original file is erased
DOnly the reference to the file is removed from the FAT and can be recovered

How the community answered

(48 responses)

A
2% (1)
B
2% (1)
C
6% (3)
D
90% (43)

Explanation

In the FAT (File Allocation Table) file system, file deletion is a logical operation, not a physical one. When a file is deleted, the operating system marks the first character of the file's directory entry with a special character (0xE5) and clears the corresponding FAT chain entries, making the clusters appear available. However, the actual file data remains physically on the disk until those clusters are overwritten by new data. This is why forensic tools can often recover 'deleted' files from FAT volumes - the data is still present, only the pointer to it has been removed. This principle is fundamental to digital forensics and data recovery.

Topics

#FAT file system#File deletion#Data recovery#File system forensics

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice