Hazel, a forensic investigator, is working with a Windows computer that has recently had several files deleted. She is tasked with determining whether the contents of these deleted files can be…

Question

Options

• AThe pointer to the files remains, but the content is deleted.
• BThe file cannot be recovered once it is deleted from the disk.
• CThe content of the files is deleted and cannot be recovered.
• DThe pointer to the files is deleted, but the content remains on the disk.

• A
  6% (2)
• B
  3% (1)
• C
  13% (4)
• D
  78% (25)

Explanation

This question aligns with CHFI v11 objectives under Data Acquisition and Duplication and File Deletion and Recovery Concepts. In Windows file systems such as NTFS, deleting a file does not immediately erase its data from the disk. Instead, the operating system removes the file system pointer (metadata entry) that references the file's location and marks the occupied disk clusters as available for reuse. CHFI v11 explains that until these disk sectors are overwritten by new data, the actual file content remains intact on the storage media. This is why deleted files often remain recoverable using forensic tools such as file carving utilities and disk analysis tools. Investigators can scan unallocated space to reconstruct files based on known file headers and footers, even when directory entries no longer exist. Exam Questions, Study Guides, Practice Tests. Lead the way to help you pass any IT Certification exams, 100% Pass Guaranteed or Full Refund. Especially Cisco, Microsoft, CompTIA, Citrix, EMC, HP, Oracle, VMware, Juniper, Check Point, LPI, Nortel, EXIN and so on. Our Slogan: First Test, First Pass. Help you to pass any IT Certification exams at the first try. You can reach us at any of the email addresses listed below. Any problems about IT certification or our products, you could rely upon us, we will give you satisfactory answers in 24 hours.

No community discussion yet for this question.