What happens when a file is deleted by a Microsoft operating system using the FAT file system?

When a file is deleted in a File Allocation Table (FAT) file system, the operating system performs a logical, not a physical, deletion. It modifies the file's 32-byte directory entry by changing the first character of the filename to a special marker (0xE5), indicating the entry is now unused. Concurrently, the cluster chain for the file within the File Allocation Table itself is cleared (typically set to zeros), marking the data clusters as free and available for reallocation. The actual data within these clusters is not erased and remains intact until the operating system overwrites that space with new data. This process makes file recovery possible.

B. the file is erased and cannot be recovered

This is incorrect. The file's data content is not erased or overwritten during a standard deletion; only its metadata pointers are removed, making recovery feasible.

C. a copy of the file is stored and the original file is erased

This describes a higher-level OS function like the Recycle Bin, not the fundamental operation of the FAT file system's deletion process.

D. the file is erased but can be recovered

This statement is contradictory. If a file's data were truly erased (i.e., overwritten), it would not be recoverable through standard undelete methods.

1. Microsoft Corporation. (2000). Microsoft Extensible Firmware Initiative FAT32 File System Specification, Version 1.03. In Section 4.2, "DIRName," the specification states: "If the first byte of DIRName is 0xE5, then the directory entry is free... When a file is deleted, the first byte of the directory entry is set to 0xE5." This confirms the modification of the directory entry, which is a primary reference.

2. Carrier, B. (2005). File System Forensic Analysis. Addison-Wesley Professional. In Chapter 10, "FAT Analysis," Section 10.1.2 "File Deletion," it is explained: "When a file is deleted in a FAT file system, two things occur. The first byte of the directory entry is changed to 0xE5 [...], and the file's entries in the FAT are cleared." This details the removal of the cluster chain reference from the FAT.

3. O'Brien, D., & Roussev, V. (2016). FAT File System. In Digital Forensics. SANS Institute. This courseware document states, "When a file is deleted, the first character of its name in the directory entry is changed to the hex value E5h... The FAT entries for the clusters occupied by the file are changed to zero, indicating that they are now available." (Module 4, File Systems, p. 18). This corroborates that the references in both the directory and the FAT are altered, but the data is not touched.