CHFI Storage Forensics and File System Analysis Practice Question

A forensic investigator is analyzing a USB drive formatted with FAT32 and finds that a deleted file's directory entry still exists but the first character of the filename is replaced with 0xE5. What does this indicate?

⚠ Common exam trap

Candidates often confuse the 0xE5 deletion marker with file attribute flags (e.g., hidden, system). In FAT32, 0xE5 in the first character of the filename indicates deletion, not a file attribute. Attribute bytes are separate in the directory entry.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The file has been deleted

In FAT32 file systems, when a file is deleted, the first byte of its directory entry's filename is replaced with the hexadecimal value 0xE5 (which displays as a lowercase sigma 'σ' in some viewers). This is the standard deletion marker for FAT file systems, indicating that the file's directory entry is available for reuse. The presence of 0xE5 in the first character position specifically signifies deletion, not any other attribute or state.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The file is marked as hidden
Why it's wrong here
The FAT directory entry uses the attribute byte at offset 0x0B to encode file metadata; a hidden file is flagged with 0x02, while the read-only, system, and volume label flags use 0x01, 0x04, and 0x08 respectively. The first byte of the filename field being 0xE5 overrides only the entry's name slot and carries no attribute semantics, so interpreting it as the hidden flag confuses the filename field with the attribute field. Additionally, 0xE5 is a special sentinel meaning the entry is available for reuse, not a bitwise attribute value.
✓
The file has been deleted
Why this is correct
When a file is deleted in a FAT file system, the first character of its 8.3 directory entry is overwritten with 0xE5, which is the standard deletion marker. This byte serves as a tombstone so the operating system knows the entry is free for new file allocation while the remaining cluster chain and directory fields stay intact until reused. Forensic analysts rely on this marker to identify deleted files and recover data by parsing the rest of the entry, including the starting cluster value and file size, making 0xE5 a direct indicator of prior deletion.
✗
The file is encrypted
Why it's wrong here
File encryption in a FAT volume is not indicated by the first byte of the filename field; on Windows, encryption is tracked by the FILE_ATTRIBUTE_ENCRYPTED flag (0x4000) in the attribute byte or by alternate data streams and EFS metadata. The value 0xE5 is exclusively defined as a deletion marker, and it does not correspond to any encryption state in the FAT directory entry structure. Moreover, FAT itself provides no built-in encryption support, so any encryption would be implemented at the filesystem driver or content level, never by altering the filename's first character.
✗
The file is fragmented
Why it's wrong here
Fragmentation is a property of how a file's data clusters are chained in the File Allocation Table, not of the directory entry's name field. A fragmented file has a sequence of cluster numbers that are not contiguous, and it is detected by traversing the FAT entry links, whereas the first byte 0xE5 always marks deletion regardless of contiguity. A deleted file can be either fragmented or intact, but the 0xE5 marker does not supply any cluster-layout information, so it cannot indicate fragmentation.

Go deeper

CHFI Storage Forensics and File System Analysis Practice Question

Why each option matters

Option-by-option breakdown

Related to this question