ExamTopics Logo
Mail Us[email protected]
Menu
Eccouncil Discussions
exam questions

Exam 312-49 All Questions

View all questions & answers for the 312-49 exam
Go to Exam

Exam 312-49 topic 1 question 298 discussion

Actual exam question from ECCouncil's 312-49
Question #: 298
Topic #: 1
[All 312-49 Questions]

While searching through a computer under investigation, you discover numerous files that appear to have had the first letter of the file name replaced by the hex code byte 5h. What does this indicate on the computer?

  • A. The files have been marked as hidden
  • B. The files have been marked for deletion
  • C. The files are corrupt and cannot be recovered
  • D. The files have been marked as read-only
Show Suggested Answer Hide Answer
Suggested Answer: B 🗳️
by giangvd at Aug. 9, 2021, 10:06 a.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
giangvd
Highly Voted 9 months ago
The OS replaces the first letter of a deleted file name with a hex byte code: E5h E5h is a special tag that indicates that the file has been deleted The corresponding cluster of that file in FAT is marked as unused, although it will continue to contain the information until it is overwritten
upvoted 5 times
...
Spudmac
Most Recent 6 months, 4 weeks ago
giangvd: good thorough explanation
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago