Computer Hacking Forensic Investigator (CHFI) — Question 25

When a file is deleted by Windows Explorer or through the MS-DOS delete command, the operating system inserts _______________ in the first letter position of the filename in the FAT database.

Answer options

• A. A Capital X
• B. A Blank Space
• C. The Underscore Symbol
• D. The lowercase Greek Letter Sigma (s)

Correct answer: D

Explanation

The correct answer is D, as the lowercase Greek Letter Sigma (s) is used to mark deleted files in the FAT file system. Options A, B, and C do not accurately represent how the FAT database indicates a deleted file, making them incorrect.