Ace Your Exams with Our Notes and Mock Tests!

EC-Council: Computer Hacking Forensic Investigator(CHFI-V10)
Module 5 : Defeating Anti-forensics Techniques
Questions available : 49		You are not logged in. Please Login for track your learning progress

Q. No: 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 |
		Go to Question No.

Question No 12

---

If you want to share the link of this question, please click here to "Copy Question Link" and share that generated link. Link from URL may change in future.

 

---

Bookmark this Question		QID: 308
Consider that you are investigating a machine running a Windows OS released prior to Windows Vista. You are trying to gather information about the deleted files by examining the master database file named INFO2 located at C:Recycler<USER SID>. You read an entry named "Dd5.exe.” . What does Dd5.exe mean?
A:    D drive, fifth file deleted, a .exe file
B:    D drive, fourth file restored, a .exe file
C:    D drive, fourth file deleted, a .exe file
D:    D drive, sixth file deleted, a .exe file
Explanation: Prior to Windows Vista, a file in the Recycle Bin was stored in its physical location and renamed using the syntax: D<#>. “D” denotes that a file has been deleted Example: De7.doc = (File is deleted from E: drive, it is the “seventh” file received by recycle bin, and is a “doc” file). 7 is the sequential number starting from one; and “doc” is the extension of the original file

Diffence opinion in Correct Answer or any comment?
Vote / Comment for correct Answer

Voting and comment option is available only for Logged in Users.
Please Login

Chosen Answer: A    B    C    D

Comment on this Answer:

Nickname to be shown:

Comunity Comments:

Admin on 17/01/2025
Opted Answer: A

Answer choice updated

0	0			Reply / response option is available only for Logged in Users. Please Login.    Registration is free!!
Your Comment / Reply Nickname to be shown
Reason for Report

Deepti on 04/11/2024
Opted Answer: A

D.
For example, in the case of a Dxy.ext file in the Recycled folder, “x” denotes the name of drive such as “C,” “D,” and others; “y” denotes the sequential number starting from one; and “ext” is the extension of the original file.

Example on previous page is wrong.

1	0			Reply / response option is available only for Logged in Users. Please Login.    Registration is free!!
Your Comment / Reply Nickname to be shown
Reason for Report

Admin on 17/01/2025

Yes. You are right.

0	0			Reply / response option is available only for Logged in Users. Please Login.    Registration is free!!
Your Comment / Reply Nickname to be shown
Reason for Report

Pradeep Thomas on 07/12/2024

In CHFI study material in Page 429 given example "De7.doc = (File is deleted from E: drive, it is the “eighth” file received by recycle bin, and is a “doc” file)" .However the in page 431 is written that "Dxy.ext the "y" denotes the sequential number starting from one".

In different books/articles, there is a difference in the sequence number starting from 0 or 1. So need to check which one is correct.

0	0			Reply / response option is available only for Logged in Users. Please Login.    Registration is free!!
Your Comment / Reply Nickname to be shown
Reason for Report

Go to Modules