nerdexam
EC-Council

312-49 · Question #521

Files stored in the Recycle Bin in its physical location are renamed as Dxy.ext, where "x" represents the ___________________.

The correct answer is A. Drive name. In older Windows systems (Windows XP and earlier), files moved to the Recycle Bin are physically stored in a hidden folder (e.g., C:\RECYCLER) and renamed using the format Dxy.ext, where D indicates a deleted file, x is the drive letter from which the file was deleted (e.g…

Submitted by zhang_li· Apr 18, 2026Disk Forensics

Question

Files stored in the Recycle Bin in its physical location are renamed as Dxy.ext, where "x" represents the ___________________.

Options

  • ADrive name
  • BOriginal file name's extension
  • CSequential number
  • DOriginal file name

How the community answered

(42 responses)
  • A
    86% (36)
  • B
    2% (1)
  • C
    2% (1)
  • D
    10% (4)

Explanation

In older Windows systems (Windows XP and earlier), files moved to the Recycle Bin are physically stored in a hidden folder (e.g., C:\RECYCLER) and renamed using the format Dxy.ext, where D indicates a deleted file, x is the drive letter from which the file was deleted (e.g., 'C' for the C: drive), y is a sequential number assigned to track multiple deleted files, and .ext is the original file extension preserved. Knowing the drive letter (x) helps forensic investigators determine the origin of recovered deleted files.

Topics

#Recycle Bin forensics#Windows file system#Deleted file artifacts#Forensic artifacts

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice