Computer Hacking Forensic Investigator (CHFI v10) — Question 581

When a file is deleted by Windows Explorer or through the MS-DOS delete command, the operating system inserts _______________ in the first letter position of the filename in the FAT database.

Answer options

• A. A Capital X
• B. A Blank Space
• C. The Underscore Symbol
• D. The lowercase Greek Letter Sigma (s)

Correct answer: D

Explanation

The correct answer is D, as the lowercase Greek Letter Sigma (s) is used by the FAT file system to indicate that a file has been deleted. The other options, such as a Capital X, Blank Space, or Underscore Symbol, do not represent the deletion status in the FAT database.