A forensics investigator is searching the hard drive of a computer for files that were recently moved to the Recycle Bin. He searches for files in C:\RECYCLED using a command line tool but does not…

The correct answer is C. The files are hidden and he must use switch to view themThe files are hidden and he must use ? Files in the Recycle Bin are stored as hidden system files. When using a command-line tool without the appropriate switch (such as /a in the Windows dir command), hidden and system files are not displayed. The investigator must include the proper switch to reveal these hidden…

Submitted by chiamaka_o· Apr 18, 2026Disk Forensics

Question

A forensics investigator is searching the hard drive of a computer for files that were recently moved to the Recycle Bin. He searches for files in C:\RECYCLED using a command line tool but does not find anything. What is the reason for this?

Options

AHe should search in C:\Windows\System32\RECYCLED folder
BThe Recycle Bin does not exist on the hard drive
CThe files are hidden and he must use switch to view themThe files are hidden and he must use ?
DOnly FAT system contains RECYCLED folder and not NTFS

How the community answered

(27 responses)

A
7% (2)
B
4% (1)
C
85% (23)
D
4% (1)

Explanation

Files in the Recycle Bin are stored as hidden system files. When using a command-line tool without the appropriate switch (such as /a in the Windows dir command), hidden and system files are not displayed. The investigator must include the proper switch to reveal these hidden files. The folder and its contents exist on the drive-they are simply not visible in a standard directory listing.

Topics

#Recycle Bin Forensics#Hidden Files#Command Line Tools#NTFS Structure

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice