A digital forensics examiner needs to recover deleted files from an NTFS volume. Which forensic concept explains why deleted files may still be recoverable?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because NTFS deletion marks the file's MFT record and cluster allocation as available for reuse but does not overwrite the actual data; forensic tools can recover these files by locating the unallocated MFT entries or carving file signatures from unallocated cluster space. A is wrong because NTFS does not automatically encrypt deleted files; EFS (Encrypting File System) is a separate opt-in feature for live files.
Full explanation below image
Full Explanation
B is correct because NTFS deletion marks the file's MFT record and cluster allocation as available for reuse but does not overwrite the actual data; forensic tools can recover these files by locating the unallocated MFT entries or carving file signatures from unallocated cluster space. A is wrong because NTFS does not automatically encrypt deleted files; EFS (Encrypting File System) is a separate opt-in feature for live files. C is wrong because the Windows Recycle Bin holds files deleted through Explorer temporarily but files deleted via command line or other methods bypass it; no 'indefinite' backup exists at the NTFS level. D is wrong because there is no 30-day system volume holding deleted files; the Recycle Bin is a user-facing feature with configurable retention, not an NTFS filesystem feature.