nerdexam
EC-CouncilEC-Council

312-49 · Question #308

312-49 Question #308: Real Exam Question with Answer & Explanation

The correct answer is D: The lowercase Greek Letter Sigma (s). When a file is deleted, the first byte is replaced with 0xE5 to marked the file as deleted or erased, and is the same for FAT12/16/32. An 0xE5 translates also to a ASCII 229, a "O" with a tilde. is "the lowercase Greek Letter Epsilon, and Ascii code 243 is Lower case Greek Letter

Submitted by miguelv· Apr 18, 2026Disk Forensics

Question

When a file is deleted by Windows Explorer or through the MS-DOS delete command, the operating system inserts _______________ in the first letter position of the filename in the FAT database.

Options

  • AA Capital X
  • BA Blank Space
  • CThe Underscore Symbol
  • DThe lowercase Greek Letter Sigma (s)

Explanation

When a file is deleted, the first byte is replaced with 0xE5 to marked the file as deleted or erased, and is the same for FAT12/16/32. An 0xE5 translates also to a ASCII 229, a "O" with a tilde. is "the lowercase Greek Letter Epsilon, and Ascii code 243 is Lower case Greek Letter Sigma. So, although D looks like the correct answer here, it may require more understanding of the underlying intent of the question.

Topics

#FAT file system#file deletion#data recovery principles#disk artifacts

Community Discussion

No community discussion yet for this question.

Full 312-49 PracticeBrowse All 312-49 Questions