Computer Hacking Forensic Investigator (CHFI v10) — Question 7

Smith, a forensic examiner, was analyzing a hard disk image to find and acquire deleted sensitive files. He stumbled upon a $Recycle.Bin folder in the root directory of the disk. Identify the operating system in use.

Answer options

• A. Windows 98
• B. Linux
• C. Windows 8.1
• D. Windows XP

Correct answer: C

Explanation

The presence of the $Recycle.Bin folder indicates that the operating system is Windows, specifically versions starting from Vista onwards. Windows 98 and Windows XP do not utilize this folder structure, and Linux does not use a $Recycle.Bin folder, making Windows 8.1 the correct choice.