Computer Hacking Forensic Investigator (CHFI v10) — Question 572

What happens when a file is deleted by a Microsoft operating system using the FAT file system?

Answer options

• A. only the reference to the file is removed from the FAT
• B. the file is erased and cannot be recovered
• C. a copy of the file is stored and the original file is erased
• D. the file is erased but can be recovered

Correct answer: A

Explanation

When a file is deleted in a FAT file system, only the reference to the file is removed from the File Allocation Table (FAT), making the space available for new files, but the actual data remains until it is overwritten. Options B and C are incorrect because they imply that the file data is completely erased or copied, which does not occur in FAT. Option D is misleading as it suggests recovery is always possible, while the file's data remains intact only until overwritten.