Which marker is placed in the first byte of a FAT directory entry to indicate that a file has been deleted?

Which marker is placed in the first byte of a FAT directory entry to indicate that a file has been deleted?

• A. The 0xE5 marker
• B. The 0x00 marker
• C. The 0x5F marker
• D. The 0xE2 marker

Answer: (A)

In FAT directory entries, a deletion is signaled by a flag in the first byte of the entry. When a file is deleted, that first byte is replaced with 0xE5, marking the entry as deleted while leaving the rest of the entry’s data intact for possible recovery. This is why forensic analysis can often recover the filename and other details even after deletion, unless those bytes have been overwritten. The alternative 0x00 indicates a free (unused) directory entry, not a deleted one. The other values aren’t standard markers for deletion in FAT directory entries.

In FAT directory entries, a deletion is signaled by a flag in the first byte of the entry. When a file is deleted, that first byte is replaced with 0xE5, marking the entry as deleted while leaving the rest of the entry’s data intact for possible recovery. This is why forensic analysis can often recover the filename and other details even after deletion, unless those bytes have been overwritten. The alternative 0x00 indicates a free (unused) directory entry, not a deleted one. The other values aren’t standard markers for deletion in FAT directory entries.