EC-Council: Computer Hacking Forensic Investigator(CHFI-V10)
Module 17 : Special Topics & Out of syllabus
         
Questions available : 3 You are not logged in.
Please Login for track your learning progress
   
 
Q. No: 1 | 2 | 3 |
Go to Question No.



Question No 0

If you want to share the link of this question, please click here to "Copy Question Link" and share that generated link. Link from URL may change in future.
 
   
Bookmark this Question
QID: 528  
   
An insider in an organization deleted all the files containing sensitive information from his Windows 7 machine on the last day of his work at the organization. These deleted files would be stored in the Recycle Bin. But, to make them untraceable, he even deleted the INFO2 file from its location, which means that no files would appear in the Recycle Bin. Now, as a forensic expert, what would you do to get the deleted files back to the Recycle Bin?


 
A:    Download the file from Microsoft website
 
B:    Restart the Windows machine
C:    Type attrib -h info* command in the command prompt
  
D:    Type attrib -s -h recycler command in the command prompt
  
         

 
 

Diffence opinion in Correct Answer or any comment?
Vote / Comment for correct Answer



Comunity Comments:

Deepti on 19/05/2025
Opted Answer: D
If a malicious insider deleted the INFO2 file, the files in the Recycle Bin would not show up, but they are still present unless they were permanently deleted or overwritten.

The command attrib -s -h recycler is used to remove the system and hidden attributes from the Recycler (or $Recycle.Bin) folder so that you can access it and inspect its contents, including possibly recovering the deleted files using forensic tools.
0 
0 

Krishna on 06/05/2024
Opted Answer: B
Rebooting Windows will trigger the recreation of INFO2 file in recycled folder. See question 8 in this section
0 
0 

Pradeep Thomas on 18/04/2025
INFO2 file deleted from its location. So attrib -s -h will not help. If we restart the windows, new INFO2 file will be created. Will previously deleted file details be available in the new INFO2 file? I think it will not be.
0 
0 

















WELCOME TO ONLINE EXAM PREPARATION SYSTEM

Certification Examinations