A digital forensics examiner needs to recover deleted files from an NTFS volume. Which forensic concept explains why deleted files may still be recoverable?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — NTFS deletion doesn't erase the data; it marks the MFT entry and clusters as available. You can often recover deleted files until new data overwrites them.
Full Explanation
The correct explanation is that when files are deleted on NTFS, the MFT entry is marked as unallocated and directory entries are removed, but the actual file data in clusters often remains intact until the clusters are overwritten by new data. Forensic tools can recover these files by locating the unallocated MFT entries or carving file signatures from unallocated cluster space. The option claiming NTFS encrypts deleted files automatically for recovery purposes is wrong because NTFS does not automatically encrypt deleted files; EFS (Encrypting File System) is a separate opt-in feature for live files. The option claiming NTFS maintains a recycle bin backup of all deleted files indefinitely is wrong because the Windows Recycle Bin holds files deleted through Explorer temporarily, but files deleted via command line or other methods bypass it, and no indefinite backup exists at the NTFS level. The option claiming deleted files are moved to a hidden system volume for 30 days before permanent deletion is wrong because there is no 30-day system volume holding deleted files; the Recycle Bin is a user-facing feature with configurable retention, not an NTFS filesystem feature.