Computer Hacking Forensic Investigator (CHFI v10) — Question 168

Randy has extracted data from an old version of a Windows-based system and discovered info file Dc5.txt in the system recycle bin. What does the file name denote?

Answer options

• A. A text file deleted from C drive in sixth sequential order
• B. A text file deleted from C drive in fifth sequential order
• C. A text file copied from D drive to C drive in fifth sequential order
• D. A text file copied from C drive to D drive in fifth sequential order

Correct answer: A

Explanation

The file name Dc5.txt indicates that it is the fifth text file deleted from the C drive, as the 'c' denotes the drive and '5' denotes the order of deletion. Options B, C, and D are incorrect because they either misidentify the order of deletion or the source and destination drives.