PrepSnap logoPrepSnap
Pass

Question

1.
2.
3.
4.
Answer (Detailed Solution Below)

Option 2 : The first byte of the filename is overwritten with the 0xE5 marker

Advertisement

Detailed Solution

सही उत्तर The first byte of the filename is overwritten with the 0xE5 marker है।

Key Points
Helpful?
PrepSnapprepsnap.in • Part -A

Question:

A deleted file on a FAT32 USB drive must be recovered. Which directory-entry detail tells the examiner that the entry belongs to a deleted file? / FAT32 USB ड्राइव पर डिलीट फाइल पुनर्प्राप्त करनी है। डायरेक्टरी-एंट्री का कौन-सा विवरण बताता है कि एंट्री डिलीट फाइल की है?

1.
The entry's cluster number is always reset to zero on deletion
2.
The first byte of the filename is overwritten with the 0xE5 marker
3.
The entry's timestamp fields are all set to the current system time
4.
The entry is moved to a hidden folder named DELETED on the same volume

Correct Answer: The first byte of the filename is overwritten with the 0xE5 marker

FAT32 marks deletion by replacing the first filename byte with 0xE5 while leaving the starting cluster and size fields intact, which is exactly what makes recovery possible. / FAT32 डिलीशन पर फाइलनाम का पहला बाइट 0xE5 से बदलता है; क्लस्टर और साइज़ फ़ील्ड बचे रहते हैं, तभी रिकवरी संभव है। Option (a) is the trap — the starting cluster is preserved, and losing it would make recovery nearly impossible.

Downloaded from PrepSnap (prepsnap.in)