CHFI Storage Forensics and File System Analysis Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  $Recycle.bin\$I

  Why this is correct

  The $I file in the Recycle Bin is the metadata companion for a deleted item, and on Windows (Vista and later) it stores the original fully-qualified path, the deletion date/time as a FILETIME value, the file size, and a unique identifier that ties it to the corresponding $R data file. This makes it the authoritative source for reconstructing where a file came from and when it was trashed, exactly what the analyst needs. Without the $I file, you would have to guess the original location from timestamps on the $R file alone.

• ✗

  C:\Windows\System32\winevt\Logs

  Why it's wrong here

  C:\Windows\System32\winevt\Logs contains the .evtx event log databases used by Windows Eventing. While event IDs such as 4663 or Sysmon 23 might report that a file was deleted if object-access auditing is configured, those logs are not populated with every Recycle Bin action and do not store the structured $I metadata (original path, deletion timestamp, size) that the Recycle Bin maintains. Event logs are also ephemeral, subject to retention policies, and require the pre-existence of an audit policy, so they cannot be treated as the canonical storage location for Recycle Bin metadata.

• ✗

  $Recycle.bin\$R

  Why it's wrong here

  $R files in the Recycle Bin hold the actual raw data content that was moved from the original location, without the original path or deletion time. A file named, for example, $RABCDEF.docx is byte-for-byte the deleted file's content, but the forensic artifacts that identify where it was deleted from live in the matching $I file. Relying on $R alone would only allow a content-based recovery, not reliable metadata recovery, so it is the wrong choice when the goal is to learn the original path and deletion time.

• ✗

  C:\Windows\Prefetch

  Why it's wrong here

  C:\Windows\Prefetch holds .pf files generated by the prefetcher to speed up application and boot processes by recording executable names, timestamps, and referenced file paths. These files are entirely unrelated to the Recycle Bin and never contain deletion metadata or entries for individual user documents. Analyzing Prefetch might reveal that an executable was run and which files it accessed, but it cannot tell you that a specific file was sent to the Recycle Bin or show its original location, making it a non-answer for this question.

Go deeper

Related to this question