Ace Your Exams with Our Notes and Mock Tests!

EC-Council: Computer Hacking Forensic Investigator(CHFI-V10)
Module 5 : Defeating Anti-forensics Techniques
Questions available : 49		You are not logged in. Please Login for track your learning progress

Q. No: 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 |
		Go to Question No.

Question No 0

---

If you want to share the link of this question, please click here to "Copy Question Link" and share that generated link. Link from URL may change in future.

 

---

Bookmark this Question		QID: 532
Jason discovered a file named $RIYG6VR.doc in the C:∖ $Recycle.Bin ∖< USER SID > ∖ while analyzing a hard disk image for the deleted data. What inferences can he make from the file name?
A:    It is a doc file deleted in seventh sequential order
B:    It is a deleted doc file
C:    RIYG6VR.doc is the name of the doc file deleted from the system
D:    It is file deleted from R drive
Explanation: n Windows Vista and later versions, the deleted files are renamed by the OS using the following format: $R<#>.<original extension>, where <#> represents a set of random letters and numbers At the same time, a corresponding metadata file is created which is named as: $I<#>.<original extension>, where <#> represents a set of random letters and numbers the same as used for $R The $R and $I files are located at C:∖$Recycle.Bin∖<USER SID>∖