312-49 · Question #498
Which code does the FAT file system use to mark the file as deleted?
The correct answer is D. E5H. In the FAT (File Allocation Table) file system, when a file is deleted, the operating system replaces the first byte of the file's directory entry (the filename field) with the hexadecimal value 0xE5 (written as E5H). This signals to the OS that the directory entry is free and…
Question
Which code does the FAT file system use to mark the file as deleted?
Options
- AESH
- B5EH
- CH5E
- DE5H
How the community answered
(25 responses)- B4% (1)
- C4% (1)
- D92% (23)
Explanation
In the FAT (File Allocation Table) file system, when a file is deleted, the operating system replaces the first byte of the file's directory entry (the filename field) with the hexadecimal value 0xE5 (written as E5H). This signals to the OS that the directory entry is free and the associated clusters can be reused, but the actual file data remains on disk until overwritten. This is why deleted FAT files are often recoverable in digital forensics - the content is intact until the clusters are allocated to new data.
Topics
Community Discussion
No community discussion yet for this question.