Guidance_Software
GD0-110 · Question #66
GD0-110 Question #66: Real Exam Question with Answer & Explanation
The correct answer is C. 5,6,7. See the full explanation below for the reasoning.
Question
Assume that MyNote.txt was allocated to clusters 5, 9, and 11. Cluster 6, 7, and 8 belong to MyResume.doc. Both files have been deleted and the directory entry in the FAT file system for MyResume.doc has been overwritten. What clusters would EnCase use to undelete MyNote.txt?
Options
- A5,9,11
- B6,7,8
- C5,6,7
- D7,8,9
Community Discussion
No community discussion yet for this question.