EC-Council: Computer Hacking Forensic Investigator(CHFI-V10)
Module 6 : Windows Forensics
         
Questions available : 94 You are not logged in.
Please Login for track your learning progress
   
 
Q. No: 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 |
Go to Question No.



Question No 0

If you want to share the link of this question, please click here to "Copy Question Link" and share that generated link. Link from URL may change in future.
 
   
Bookmark this Question
QID: 761  
   
While searching through a computer under investigation, you discover numerous files that appear to have had the first letter of the file name replaced by the hex code byte 5h. What does this indicate on the computer?


 
A:    The files have been marked as hidden
 
B:    The files have been marked for deletion
C:    The files are corrupt and cannot be recovered
  
D:    The files have been marked as read-only
 
         

 
 

Diffence opinion in Correct Answer or any comment?
Vote / Comment for correct Answer



Comunity Comments:

Deepti on 18/05/2025
Opted Answer: B
In some forensic tools or disk hex viewers, this E5h character may appear as 05h due to character encoding interpretations or tool-specific rendering.
0 
0 

Pradeep Thomas on 19/05/2024
Opted Answer: B
The OS replaces the first letter of a deleted file name with a hex byte code: E5h. So need to check any purpose for replace with 5h or question is wrong...
0 
0 

















WELCOME TO ONLINE EXAM PREPARATION SYSTEM

Certification Examinations