nerdexam
EC-Council

312-49 · Question #308

When a file is deleted by Windows Explorer or through the MS-DOS delete command, the operating system inserts _______________ in the first letter position of the filename in the FAT database.

The correct answer is D. The lowercase Greek Letter Sigma (s). When a file is deleted, the first byte is replaced with 0xE5 to marked the file as deleted or erased, and is the same for FAT12/16/32. An 0xE5 translates also to a ASCII 229, a "O" with a tilde. is "the lowercase Greek Letter Epsilon, and Ascii code 243 is Lower case Greek…

Submitted by miguelv· Apr 18, 2026Disk Forensics

Question

When a file is deleted by Windows Explorer or through the MS-DOS delete command, the operating system inserts _______________ in the first letter position of the filename in the FAT database.

Options

  • AA Capital X
  • BA Blank Space
  • CThe Underscore Symbol
  • DThe lowercase Greek Letter Sigma (s)

How the community answered

(38 responses)
  • B
    3% (1)
  • C
    3% (1)
  • D
    95% (36)

Explanation

When a file is deleted, the first byte is replaced with 0xE5 to marked the file as deleted or erased, and is the same for FAT12/16/32. An 0xE5 translates also to a ASCII 229, a "O" with a tilde. is "the lowercase Greek Letter Epsilon, and Ascii code 243 is Lower case Greek Letter Sigma. So, although D looks like the correct answer here, it may require more understanding of the underlying intent of the question.

Topics

#FAT file system#file deletion#data recovery principles#disk artifacts

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice