CHFI Storage Forensics and File System Analysis Practice Question
An investigator is examining a FAT32 filesystem and needs to recover a deleted file. In FAT32, the directory entry for a deleted file has the first byte of the filename set to 0xE5. What does this indicate?
⚠ Common exam trap
Many exam-takers confuse the 0xE5 deletion marker with other attribute flags (like hidden or system) or assume it indicates encryption, because they memorize attribute bits but overlook the specific byte value used for deletion in FAT directory entries.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file has been deleted
In FAT32, when a file is deleted, the directory entry's first byte (the filename's first character) is overwritten with the value 0xE5. This is a deliberate marker used by the file system to indicate that the entry is available for reuse, meaning the file has been logically deleted. The data clusters remain intact until overwritten, which is why recovery tools look for entries with this byte to restore deleted files.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The file is a system file
Why it's wrong here
The FAT32 directory entry stores the file's system attribute in the attribute byte at offset 0x0B, not in the first byte of the entry. A system file has bit 0x04 set in that attribute byte while its filename remains intact at offset 0x00. The value 0xE5 at offset 0x00 specifically signals that the first character of the filename has been replaced with the deletion marker, so a system file would not show 0xE5 unless it was also deleted.
- ✗
The file is hidden
Why it's wrong here
The hidden attribute in FAT32 is a flag in the attribute byte (bit 0x02 at offset 0x0B) and does not overwrite the filename's first character. A hidden file retains an intact name in the directory entry, so its first byte would still be the actual first character of the name, not 0xE5. The 0xE5 marker is exclusively used for deleted entries, where the first character is deliberately replaced to indicate the entry is available for reuse—hidden files are not marked that way.
- ✗
The file is encrypted
Why it's wrong here
FAT32 has no encryption attribute or flag in its directory entry structure; encryption like EFS is a feature of NTFS, not FAT. The first byte 0xE5 is not any kind of encryption indicator—it is a value that overwrites the leading filename character to mark the directory entry as deleted. Even an encrypted file on a FAT volume would retain its filename and normal attribute byte, so 0xE5 cannot be interpreted as an encryption marker.
- ✓
The file has been deleted
Why this is correct
In FAT32, when a file or directory is deleted, the first byte of its 8.3 directory entry is replaced with 0xE5, which serves as a deletion/free marker. This is why 0xE5 in the first byte of a directory entry is a reliable indicator that the file has been deleted (or the directory entry is free). The remainder of the entry—including the starting cluster number, file size, and timestamps—often remains unchanged until the entry is reused, which is what makes data recovery possible.
Go deeper
Related to this question
About these practice questions
One of 205 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.