312-49 · Question #262
312-49 Question #262: Real Exam Question with Answer & Explanation
The correct answer is A: The data is still present until the original location of the file is used. When a file is deleted from the Recycle Bin (or any file is deleted in Windows), the operating system does not immediately erase the file's data from the disk. Instead, it simply marks the clusters occupied by the file as 'available' in the file system's allocation table (e.g., M
Question
Why is it still possible to recover files that have been emptied from the Recycle Bin on a Windows computer?
Options
- AThe data is still present until the original location of the file is used
- BThe data is moved to the Restore directory and is kept there indefinitely
- CThe data will reside in the L2 cache on a Windows computer until it is manually deleted
- DIt is not possible to recover data that has been emptied from the Recycle Bin
Explanation
When a file is deleted from the Recycle Bin (or any file is deleted in Windows), the operating system does not immediately erase the file's data from the disk. Instead, it simply marks the clusters occupied by the file as 'available' in the file system's allocation table (e.g., MFT in NTFS). The actual data remains physically on the disk until those clusters are allocated to and overwritten by new data. This is why forensic tools can recover 'deleted' files — they scan for data in clusters marked as free. The data is NOT moved to a Restore directory indefinitely, and it does NOT reside in L2 cache (which is volatile CPU cache, not persistent storage).
Topics
Community Discussion
No community discussion yet for this question.