Computer Hacking Forensic Investigator (CHFI v10) — Question 136

When a user deletes a file, the system creates a $I file to store its details. What detail does the $I file not contain?

Answer options

• A. File Size
• B. File origin and modification
• C. Time and date of deletion
• D. File Name

Correct answer: B

Explanation

The correct answer is B because the $I file does not retain information about where the file originated or its modification history. In contrast, the other details such as file size, time and date of deletion, and file name are all recorded in the $I file.