112-57: Threat Intelligence EssentialsDemo

By ECCouncil · Question Mode

QuestionQ71

Threat Hunting and Detection

Which Windows file system replaces the first character of a deleted file name with the hexadecimal byte code “Eh5”?

  • A EFS
  • B FHS
  • C FAT
  • D NTFS
Explanation

The FAT file system marks a deleted directory entry by replacing the first byte of the file name with the hexadecimal value E5h, allowing the entry to be recognized as deleted until its storage is reused.

Community Discussion

No comments yet. Be the first to start the discussion!