Computer Hacking Forensic Investigator (CHFI v10) — Question 510

Why is it still possible to recover files that have been emptied from the Recycle Bin on a Windows computer?

Answer options

• A. The data is still present until the original location of the file is used
• B. The data is moved to the Restore directory and is kept there indefinitely
• C. The data will reside in the L2 cache on a Windows computer until it is manually deleted
• D. It is not possible to recover data that has been emptied from the Recycle Bin

Correct answer: A

Explanation

The correct answer is A because when files are deleted from the Recycle Bin, the data remains on the disk until that space is overwritten by new data. Options B and C are incorrect as there is no Restore directory for deleted files and they do not reside in the L2 cache. Option D is also wrong since recovery is possible until the data is overwritten.