Computer Hacking Forensic Investigator (CHFI) — Question 121

When examining a hard disk without a write-blocker, you should not start windows because Windows will write data to the:

Answer options

• A. Recycle Bin
• B. MSDOS.sys
• C. BIOS
• D. Case files

Correct answer: A

Explanation

The correct answer is A because Windows automatically modifies certain system areas, including the Recycle Bin, during startup. The other options, such as MSDOS.sys, BIOS, and Case files, are not directly impacted by Windows writing data upon startup in the same way as the Recycle Bin is.