Exam 312-49v10 topic 1 question 231 discussion

reason the forensics investigator did not find anything in the C:\RECYCLED folder is that the Recycle Bin is not directly accessible through that path. Instead, the Recycle Bin is typically located in the C:\$Recycle.Bin directory on NTFS volumes. So, the correct answer is D. Only FAT system contains RECYCLED folder and not NTFS.

A. He should search in C:\Windows\System32\RECYCLED folder --> wrong, the correct directory would be C:\RECYCLED B. The Recycle Bin does not exist on the hard drive --> also wrong. Recycle Bin is a service that exist is all windows based system and cannot be deleted D. Only FAT system contains RECYCLED folder and not NTFS --> both NTFS and FAT can contains RECYCLED. The difference is windows vista and above have changed its name to \$Recycle.Bin C. The files are hidden and he must use switch to view them --> best answer, although this could be wrong too