Smith, a forensic examiner, was analyzing a hard disk image to find and acquire deleted sensitive files. He stumbled upon a $Recycle.Bin folder in the root directory of the disk. Identify the operating system in use.
From the Official CHFI Exam guide: Chapter 4, pg. 208
"■ On FAT file systems, the folder is named Recycled. For example, on your C: the
storage location of the Recycle Bin would be C:\RECYCLED.
■ On NTFS file systems used by Windows NT, 2000, and XP, this folder is named
Recycler. For example, on your C: the storage location of the Recycle Bin would be
C:\RECYCLER.
■ On NTFS file systems used by Windows Vista, this folder is named $Recycle.Bin. For
example, on your C: the storage location of the Recycle Bin would be
C:\RECYCLE.BIN."
So seems clear, answer should be C
Drive:\Recycled = Win 98 and Prior Win Versions
Drive:\Recycler = Win 2000, Win XP & Win NT
Drive:\$Recycle.Bin = Win Vista, Win 7, Win 8, Win 10, Win...
With these few points of mine, the answer is "C".
This section is not available anymore. Please use the main Exam Page.312-49 Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
MarcoSenno
Highly Voted 2 years, 5 months agoMrRubi
Most Recent 10 months, 3 weeks agoBodescu
2 years, 1 month agoCytrail
2 years, 3 months agoBright07
2 years, 4 months agotooaungyan
2 years, 8 months ago