Computer Hacking Forensic Investigator (CHFI) — Question 87

While searching through a computer under investigation, you discover numerous files that appear to have had the first letter of the file name replaced by the hex code byte 5h. What does this indicate on the computer?

Answer options

• A. The files have been marked as hidden
• B. The files have been marked for deletion
• C. The files are corrupt and cannot be recovered
• D. The files have been marked as read-only

Correct answer: B

Explanation

The presence of hex code byte 5h indicates that the files are flagged for deletion, which aligns with option B being the correct answer. Options A, C, and D do not accurately describe the implications of the hex code byte in this context, as they pertain to different file attributes that are not indicated by the modification of the file name's first letter.