Computer Hacking Forensic Investigator (CHFI) — Question 45

When a user deletes a file or folder, the system stores complete path including the original filename is a special hidden file called "INFO2" in the Recycled folder. If the INFO2 file is deleted, it is recovered when you ______________________.

Answer options

• A. Undo the last action performed on the system
• B. Reboot Windows
• C. Use a recovery tool to undelete the file
• D. Download the file from Microsoft website

Correct answer: A

Explanation

The correct answer is A because 'Undo the last action performed on the system' will restore the deleted file or folder, including its path in INFO2. The other options do not directly address the recovery of the INFO2 file; rebooting (B) or downloading (D) does not affect the INFO2, and using a recovery tool (C) would not specifically restore the INFO2 file without undoing the action.