Computer Hacking Forensic Investigator (CHFI v10) — Question 133

When a user deletes a file or folder, the system stores complete path including the original filename is a special hidden file called `INFO2` in the Recycled folder. If the INFO2 file is deleted, it is recovered when you ______________________.

Answer options

• A. Undo the last action performed on the system
• B. Reboot Windows
• C. Use a recovery tool to undelete the file
• D. Download the file from Microsoft website

Correct answer: C

Explanation

The correct answer is C because using a recovery tool specifically designed for undeleting files can restore the deleted INFO2 file. Options A and B do not address the need for recovery tools, and D is incorrect as Microsoft does not provide downloads for deleted files.