nerdexam
EC-Council

312-49 · Question #580

Randy has extracted data from an old version of a Windows-based system and discovered info file Dc5.txt in the system recycle bin. What does the file name denote?

The correct answer is B. A text file deleted from C drive in fifth sequential order. In older Windows systems (pre-Vista), the Recycle Bin renamed deleted files using a specific naming convention: 'D' indicates the file was Deleted, the lowercase letter following 'D' indicates the source drive letter (here 'c' = C drive), the number indicates the sequential…

Submitted by tarun92· Apr 18, 2026Disk Forensics

Question

Randy has extracted data from an old version of a Windows-based system and discovered info file Dc5.txt in the system recycle bin. What does the file name denote?

Options

  • AA text file deleted from C drive in sixth sequential order
  • BA text file deleted from C drive in fifth sequential order
  • CA text file copied from D drive to C drive in fifth sequential order
  • DA text file copied from C drive to D drive in fifth sequential order

How the community answered

(32 responses)
  • A
    3% (1)
  • B
    88% (28)
  • C
    6% (2)
  • D
    3% (1)

Explanation

In older Windows systems (pre-Vista), the Recycle Bin renamed deleted files using a specific naming convention: 'D' indicates the file was Deleted, the lowercase letter following 'D' indicates the source drive letter (here 'c' = C drive), the number indicates the sequential order in which files were deleted (here '5' = fifth file deleted), and the extension (.txt) is the original file extension. Therefore, Dc5.txt means the fifth file deleted from the C drive, and it was originally a text file.

Topics

#Windows Forensics#Recycle Bin Artifacts#File Naming Conventions

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice