Computer Hacking Forensic Investigator (CHFI v10) — Question 198

Which code does the FAT file system use to mark the file as deleted?

Answer options

• A. ESH
• B. 5EH
• C. H5E
• D. E5H

Correct answer: D

Explanation

The correct answer is D, E5H, which is the specific code the FAT file system uses to signify that a file is deleted. The other options do not represent the correct code used by FAT for marking deleted files.