Smith, a forensic examiner, was analyzing a hard disk image to find and acquire deleted sensitive files. He stumbled upon a $Recycle.Bin folder in the root directory of the disk. Identify the operating system in use.
https://bookshelf.vitalsource.com/reader/books/9781635676969/pageid/443
Module 05: Defeating Anti-forensics Tecniques / LO#02: Discuss Data Deletion and Recycle Bin Forensics / Recycle Bin in Windows
Page 444:
The storage location of Recycle Bin depends on type of OS and file system
Recycle Bin storage location on FAT file systems:
On older FAT file systems (Windows 98 and prior), it is located in Drive:\RECYCLED
Recycle Bin storage location on NTFS file systems:
On Windows 2000, NT, and XP it is located in Drive:\RECYCLER\<SID>
On Windows Vista and later versions, it is located in Drive:\$Recycle.Bin\<SID>
--> Windows 8.1
From EC Council: In Windows Vista and later versions, the deleted files are renamed by the OS using the following format: $ [...] The $R and $I files are located at C:\$Recycle.Bin\<USER SID>\
It´s supposed that Drive\RECYCLER is the answer for XP and $Recycle.Bin for vista and later versions. I suppose is correct in the context but not in the content according to the CHFI V9 Module 5 page 472
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Dumas
1 year, 1 month agotorabi123
1 year, 9 months agomarymayhem
2 years, 1 month agodiomaya
2 years, 2 months agohisham
2 years, 2 months agoEREBBUS
3 years, 6 months agovroche
3 years, 7 months agoChaoticda
3 years, 7 months agodavideselvaggi
3 years, 8 months ago