PrepSnap logoPrepSnap
Pass

Question

1.
2.
3.
4.
Answer (Detailed Solution Below)

Option 2 : exFAT deletion clears the allocation bitmap and FAT chain but leaves the actual cluster contents untouched until overwritten

Advertisement

Detailed Solution

सही उत्तर exFAT deletion clears the allocation bitmap and FAT chain but leaves the actual cluster contents untouched until overwritten है।

Key Points
Helpful?
PrepSnapprepsnap.in • Part -A

Question:

A deleted video is carved from an exFAT SD card even though its directory entry is gone. Why does header-based carving still work here? / डायरेक्टरी एंट्री मिटने के बावजूद exFAT SD कार्ड से डिलीट वीडियो कार्व किया गया। हेडर-आधारित कार्विंग यहाँ क्यों काम करती है?

1.
exFAT keeps a hidden backup copy of every deleted file's clusters
2.
exFAT deletion clears the allocation bitmap and FAT chain but leaves the actual cluster contents untouched until overwritten
3.
exFAT never truly deletes anything and the entry can always be undeleted
4.
exFAT stores video data inside the directory entry itself

Correct Answer: exFAT deletion clears the allocation bitmap and FAT chain but leaves the actual cluster contents untouched until overwritten

Like most filesystems, exFAT deletion only frees the bookkeeping structures; the data clusters remain intact until reallocated, which is exactly what carving exploits. / exFAT डिलीशन पर सिर्फ बहीखाता संरचनाएँ मुक्त करता है; डेटा क्लस्टर पुनः आवंटन तक बचे रहते हैं — कार्विंग इसी का लाभ उठाती है। Option (c) is the trap — the entry is genuinely cleared, not hidden.

Downloaded from PrepSnap (prepsnap.in)