On a FAT-based file system, what happens when a file is deleted?

On a FAT-based file system, what happens when a file is deleted?

• A. The file is erased and cannot be recovered
• B. The file is erased but can be recovered partially
• C. A copy of the file is stored and the original file is erased
• D. Only the reference to the file is removed from the FAT and can be recovered

Answer: (A)

Deleting a file on a FAT file system is a metadata operation, not an immediate data wipe. When you delete, the system marks the directory entry as deleted and frees the clusters in the FAT, but the actual bytes that made up the file remain on disk until those sectors are overwritten by new data. Because the original data can still exist in those sectors, forensic tools can often recover the file by reconstructing the cluster chain and reassembling its contents. Only if the space is overwritten or a secure-delete process is used would recovery be unlikely. So, in standard FAT deletion, the data is typically recoverable, which is why the notion of it being erased and irrecoverable isn’t generally accurate.

Deleting a file on a FAT file system is a metadata operation, not an immediate data wipe. When you delete, the system marks the directory entry as deleted and frees the clusters in the FAT, but the actual bytes that made up the file remain on disk until those sectors are overwritten by new data. Because the original data can still exist in those sectors, forensic tools can often recover the file by reconstructing the cluster chain and reassembling its contents. Only if the space is overwritten or a secure-delete process is used would recovery be unlikely. So, in standard FAT deletion, the data is typically recoverable, which is why the notion of it being erased and irrecoverable isn’t generally accurate.