nerdexam
EC-Council

312-49 · Question #548

When a user deletes a file or folder, the system stores complete path including the original filename is a special hidden file called "INFO2" in the Recycled folder. If the INFO2 file is deleted, it…

The correct answer is A. Undo the last action performed on the system. If the INFO2 file in the Recycle Bin is deleted as the most recent action (for example, by manually deleting it through Windows Explorer), performing an Undo (Ctrl+Z) on that last action will restore the file. Windows tracks file operations in Explorer and can reverse the most…

Submitted by sofia.br· Apr 18, 2026Disk Forensics

Question

When a user deletes a file or folder, the system stores complete path including the original filename is a special hidden file called "INFO2" in the Recycled folder. If the INFO2 file is deleted, it is recovered when you ______________________.

Options

  • AUndo the last action performed on the system
  • BReboot Windows
  • CUse a recovery tool to undelete the file
  • DDownload the file from Microsoft website

How the community answered

(43 responses)
  • A
    91% (39)
  • B
    5% (2)
  • C
    2% (1)
  • D
    2% (1)

Explanation

If the INFO2 file in the Recycle Bin is deleted as the most recent action (for example, by manually deleting it through Windows Explorer), performing an Undo (Ctrl+Z) on that last action will restore the file. Windows tracks file operations in Explorer and can reverse the most recent deletion via the undo function, recovering the INFO2 file along with its stored metadata about previously deleted files.

Topics

#Recycle Bin#INFO2 file#File deletion mechanisms#Windows OS artifacts

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice