In the context of file deletion process, which statement holds true?

• A. Data is overwritten and the cluster is marked as available
• B. The longer a disk is in use, the less likely deleted files will be overwritten
• C. While booting, the machine may create temporary files that can delete evidence
• D. Secure delete programs work by completely overwriting the file in one go

Answer: (C)

Deleting a file typically does not immediately erase its data; the OS usually just marks the file’s clusters as free, leaving the actual bytes on disk until they’re overwritten by new writes. During system boot, temporary files, caches, and other boot-time activity can write to disk, potentially overwriting the sectors that held deleted data and destroying evidence. This is why the statement about temporary files created while booting having the potential to delete evidence is the most accurate. The other ideas aren’t as reliable: deletion often doesn’t overwrite the data right away; the more a disk is in use, the greater the chance of overwriting deleted data (not the reverse); and secure delete tools typically perform multiple overwrite passes rather than a single pass.