After a file is deleted on a FAT file system, what is the status of its data blocks?

Enhance your knowledge as a Computer Hacking Forensic Investigator with the CHFI v11 Test. Use flashcards and multiple-choice questions, complete with hints and detailed explanations, to prepare effectively and ace your exam!

Multiple Choice

After a file is deleted on a FAT file system, what is the status of its data blocks?

Explanation:
The key idea is that deleting a file on FAT unlinks it and frees its storage. When you delete, the directory entry is cleared and the clusters it used are marked as unallocated in the FAT. The data blocks themselves aren’t erased immediately; they still contain the file’s bytes, but they’re no longer associated with any file and can be reused by the filesystem. So the correct understanding is that the data remains, but the file is no longer linked to it. This is why deleted data can sometimes be recovered until those blocks are overwritten. The other options don’t fit because deletion doesn’t immediately overwrite data, mark blocks as bad, or compress them.

The key idea is that deleting a file on FAT unlinks it and frees its storage. When you delete, the directory entry is cleared and the clusters it used are marked as unallocated in the FAT. The data blocks themselves aren’t erased immediately; they still contain the file’s bytes, but they’re no longer associated with any file and can be reused by the filesystem. So the correct understanding is that the data remains, but the file is no longer linked to it. This is why deleted data can sometimes be recovered until those blocks are overwritten. The other options don’t fit because deletion doesn’t immediately overwrite data, mark blocks as bad, or compress them.

Subscribe

Get the latest from Examzify

You can unsubscribe at any time. Read our privacy policy