Randy has extracted data from an old version of a Windows-based system and discovered info file Dc5.txt in the system recycle bin. What does the file name denote?
A.
A text file deleted from C drive in sixth sequential order
B.
A text file deleted from C drive in fifth sequential order
C.
A text file copied from D drive to C drive in fifth sequential order
D.
A text file copied from C drive to D drive in fifth sequential order
So, correcting last statement:
Prior Vista the “y” denotes sequential number starting from 0, not one.
On Vista and later, the “y” denotes the sequential number starting from one, not 0.
Prior Vista the sequential number started from one.
In Windows Vista and later versions the sequential number starts from 0.
[ selecting A ] cause its says "old windows" but answer can be option B as well cause Vista now days is an old windows version too.
https://info-savvy.com/understand-anti-forensics-techniques/
B is correct
However there is a mistake in the CHFI V10 book.
In page 429 the example is wrong. Is is written that: "De7.doc is the eighth file". It is false it is the 7th.
However the text in page 431 is correct. It is written that "Dxy.ext the "y" denotes the sequential number starting from one".
I have resintalled an XP machine to check and I confirm that the sequence starts at 1.
Actually, in the context of Windows Recycle Bin file naming conventions, the number does not start at zero. The number represents the sequential order of deletion starting from one. So, 5 indeed means it is the fifth document deleted from the C: drive
No, per EC council material: "For example, in the case of a Dxy.ext file in the Recycled folder, “x” denotes the name of drive such as “C,” “D,” and others; “y” denotes the sequential number starting from one; "
upvoted 1 times
...
...
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Elb
6 months, 1 week agoElb
6 months, 1 week agoMalko59
1 year, 3 months agoredmonkeyprism
1 year, 5 months ago4bd3116
4 months agozybr
1 year, 4 months ago