When EnCase recovers NTFS files and folders, it searches the Master File Table (MFT). If a parent folder for an entry cannot be located, it places the entry in the Lost Files folder. This folder contains files parsed from unallocated clusters of the MFT, allowing you to see those deleted files. Keep in mind that this behavior is specific to NTFS volumes; FAT does not work the same way12. So, the correct answer is B.
B < NTFS is a file system that uses a database called a master file table (MFT) to store information about every file and directory stored in the file system. This replaces the file allocation table used by the FAT file system.
upvoted 1 times
...
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
aqeel1506
4 months, 1 week agoElb
6 months, 3 weeks ago