CHFI Chapter 5-6 Questions with 100% Verified Solutions

Windows: When a user deletes a file, the OS does not actually delete the file, it - marks the file name in the Master File Table (MFT) with a special character. This character represents that the space once occupied by the file is ready for use FAT - The OS replaces the first letter of the deleted filename with - E5H, Corresponding clusters of that file are marked unused, even though they are not empty. Until these clusters are overwritten, the file can still be recovered Deleted files in NTFS - The OS marks the index field in the MFT with a special code. - The computer now looks at the clusters occupied by that file as being empty. Until these clusters are overwritten, the file can be recovered Recycle Bin - A place to store files that are marked for deletion. The exceptions are large files and files from removable media Setting Windows registry key "HKLMSYSTEMCurrentControlSetControlFileSystemNtfsDisableLastAccessUpdate" to 1 - disables updating of the last-accessed timestamp What Happens When a File is Deleted? Windows 98 and earlier (FAT) - - C:Recycled (4GB limit - Files are named D