Guidance_Software
GD0-100 · Question #62
To undelete a file in the FAT file system, EnCase obtains the starting extent from the:
The correct answer is D. Directory entry. See the full explanation below for the reasoning.
Question
To undelete a file in the FAT file system, EnCase obtains the starting extent from the:
Options
- AFAT
- BFile header
- COperating system
- DDirectory entry
How the community answered
(43 responses)- A5% (2)
- B2% (1)
- C12% (5)
- D81% (35)
Community Discussion
No community discussion yet for this question.