PrepSnap logoPrepSnap
Pass

Question

1.
2.
3.
4.
Answer (Detailed Solution Below)

Option 1 : The file's MFT record, whose IN_USE flag is cleared but whose resident or non-resident data runs may still be intact

Advertisement

Detailed Solution

सही उत्तर The file's MFT record, whose IN_USE flag is cleared but whose resident or non-resident data runs may still be intact है।

Key Points
Helpful?
PrepSnapprepsnap.in • Part -A

Question:

On an NTFS volume, a deleted document must be recovered. The examiner should first inspect / NTFS वॉल्यूम पर डिलीट किया दस्तावेज़ पुनर्प्राप्त करना है। परीक्षक को सबसे पहले क्या देखना चाहिए?

1.
The file's MFT record, whose IN_USE flag is cleared but whose resident or non-resident data runs may still be intact
2.
The $Bitmap file, because it stores the actual contents of deleted files
3.
The $LogFile, because it permanently archives every deleted file's data
4.
The boot sector, because it keeps a backup copy of all deleted MFT entries

Correct Answer: The file's MFT record, whose IN_USE flag is cleared but whose resident or non-resident data runs may still be intact

Deletion only clears the MFT entry's in-use flag and deallocates clusters; the record and its data runs often survive until overwritten, making the MFT the first place to look. / डिलीशन सिर्फ IN_USE फ्लैग हटाता है; MFT रिकॉर्ड और डेटा रन्स अक्सर बचे रहते हैं। Option (c) is the trap — $LogFile is a short circular transaction journal, not an archive.

Downloaded from PrepSnap (prepsnap.in)