Which file system is known for storing deleted files in the INFO2 file?

Study for the Investigations and Evidence Recovery Test with our resources. Explore multiple choice questions, flashcards, and detailed explanations. Prepare effectively to excel in your exam!

The file system that is known for storing deleted files in the INFO2 file is NTFS (New Technology File System). This system is widely used in Windows operating environments and includes advanced features such as security permissions, compression, and support for large file sizes and volumes.

One significant aspect of NTFS is its approach to file deletions. When files are deleted, they aren’t immediately erased from the disk. Instead, NTFS retains metadata about these files in the INFO2 file, which is utilized by the Recycle Bin. This metadata includes details such as the original path of the deleted file and the date and time it was deleted. This capability enables users to recover deleted files easily if they are moved to the Recycle Bin.

Other file systems mentioned, such as FAT16, Ext3, and HPFS, do not have a similar mechanism for storing deleted file information in a dedicated metadata structure like the INFO2 file. Therefore, the distinct ability of NTFS to manage deleted files through this metadata system is what makes it the correct choice in this context.

Subscribe

Get the latest from Examzify

You can unsubscribe at any time. Read our privacy policy