Computer Hacking Forensic Investigator (CHFI) — Question 99

What happens when a file is deleted by a Microsoft operating system using the FAT file system?

Answer options

• A. only the reference to the file is removed from the FAT
• B. the file is erased and cannot be recovered
• C. a copy of the file is stored and the original file is erased
• D. the file is erased but can be recovered

Correct answer: A

Explanation

When a file is deleted in a FAT file system, only the reference to the file is removed from the File Allocation Table, meaning the data remains intact until overwritten. Options B and C are incorrect because they suggest the file is permanently erased or that a copy is made, which does not happen in this scenario. Option D is also wrong, as the file can be recovered until the space it occupied is overwritten, but the reference itself is what is deleted.