A forensics investigator is searching the hard drive of a computer for files that were recently moved to the Recycle Bin. He searches for files in C:RECYCLED using a command line tool but does not find anything. What is the reason for this?

A. He should search in C:WindowsSystem32RECYCLED folder

B. The Recycle Bin does not exist on the hard drive

C. The files are hidden and he must use switch to view them

D. Only FAT system contains RECYCLED folder and not NTFS








 

Suggested Answer: C





This question is in 312-49 Computer Hacking Forensic Investigator Exam. 
For getting Computer Hacking Forensic Investigator (CHFI).







Disclaimers:
The website is not related to, affiliated with, endorsed or authorized by EC-Council. 
Trademarks, certification & product names are used for reference only and belong to EC-Council.
The website does not contain actual questions and answers from EC-Council's Certification Exams.