Exam (elaborations)
CHFI Chapter 5 Questions with 100% Verified Solutions
- Course
- Institution
When a FAT File is deleted - The OS replaces the first letter of the deleted filename with E5H. Corresponding clusters of that file are marked unused, even though they are not empty. Until these clusters are overwritten, the file can still be recovered. When a NTFS File is deleted - The OS marks...
[Show more]