While examining a Windows workstation as part of a digital-fraud investigation in Seattle, Washington, forensic...

The best answer is C because it captures the core NTFS behavior most directly. When a file is deleted on NTFS, the file’s MFT record is marked unused or unallocated, while the underlying file content on disk usually remains in place until those clusters are reused by another file. The Sleuth Kit documentation notes that, on deletion, the MFT entry is marked unused and the relevant bitmaps are updated, but the data itself is not immediately erased. This is why deleted files may remain recoverable for some time. Option A is partially true because cluster allocation is updated in the bitmap, but it describes only part of the mechanism and not the key forensic point that the actual content is still present. Option D describes the consequence of deletion rather than the file-system behavior itself. Option B is associated with older FAT-style deletion concepts, not the NTFS behavior being tested here. Under CHFI v11, understanding how deleted files persist until overwritten is central to file recovery and anti-forensics analysis.