312-49V11: Computer Hacking Forensic InvestigatorDemo

By ECCouncil · Question Mode

QuestionQ28

Digital Evidence

A cybercriminal attempts to remove evidence from a Windows computer. He deletes the file evidence1.doc, sending it to the Windows Recycle Bin, and then empties the Recycle Bin. After the file has been removed from the Recycle Bin, what happens to its data?

  • A The data will remain in its original clusters until it is overwritten
  • B The data will be overwritten with zeroes
  • C The data will be moved to new clusters in unallocated space
  • D The data will become corrupted, making it unrecoverable
Explanation

Emptying the Recycle Bin normally deletes the file’s filesystem record and marks its original disk clusters as unallocated; it does not immediately erase their contents. The data remains in those clusters until subsequent writes overwrite it.

Community Discussion

No comments yet. Be the first to start the discussion!