Computer Hacking Forensic Investigator (CHFI) — Question 28

Randy has extracted data from an old version of a Windows-based system and discovered info file Dc5.txt in the system recycle bin. What does the file name denote?

Answer options

• A. A text file deleted from C drive in sixth sequential order
• B. A text file deleted from C drive in fifth sequential order
• C. A text file copied from D drive to C drive in fifth sequential order
• D. A text file copied from C drive to D drive in fifth sequential order

Correct answer: B

Explanation

The '5' in Dc5.txt indicates that it was the fifth file deleted from the C drive, making option B correct. Option A is incorrect as it refers to the sixth file, and options C and D incorrectly imply copying rather than deletion.