CHFI Storage Forensics and File System Analysis Practice Question
An analyst is examining a Windows 10 system and discovers a file in the $Recycle.bin folder with a name like '$RABCDEF.txt'. The analyst wants to recover the original file path and deletion date. Which forensic artifact should the analyst examine?
⚠ Common exam trap
EC-Council CHFI often tests the misconception that the $R file itself contains metadata like the original path or deletion date, when in fact the $R file is only the data content, and all metadata is stored exclusively in the corresponding $I file.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The corresponding $I file (e.g., $IABCDEF.txt) in $Recycle.bin
The $I file (e.g., $IABCDEF.txt) in the $Recycle.bin folder is the index file that stores metadata about the deleted file, including the original file path, original size, and the date and time when the file was deleted. The $R file contains only the actual data content of the deleted file, not its metadata. Therefore, examining the corresponding $I file is the correct method to recover the original file path and deletion date.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The corresponding $I file (e.g., $IABCDEF.txt) in $Recycle.bin
Why this is correct
The $I file in the $Recycle.bin folder is an index entry created when a file is deleted via Explorer; it stores the original file name, full path before deletion, and the deletion timestamp. Because the $R file is renamed to a random name, the $I file is the authoritative source for reconstructing the original location and time. Forensic tools parse $I files to recover this metadata directly.
- ✗
The Windows Event Logs
Why it's wrong here
Windows Event Logs do not reliably record individual file deletions; security auditing for object access must be explicitly enabled and even then typically logs activity such as deletion, but does not store the original file path or deletion timestamp in a standard event. The default Windows 10 configuration does not maintain a per-file deletion history, so logs lack the needed metadata. Thus Event Logs are not a dependable source for original path or deletion time.
- ✗
The USN journal
Why it's wrong here
The USN journal (Update Sequence Number) records changes to files on NTFS volumes, including deletion, but stores only the file reference number and reason flags, not the original path in a human-readable form. To recover the path, one must resolve the file reference through the MFT, and for deleted files the path is not directly stored. It also does not provide the deletion timestamp with the same precision or context as the $I file.
- ✗
The $MFT entry for the $R file
Why it's wrong here
The $MFT entry for the $R file describes the file's attributes, such as size, timestamps, and data runs, but it contains no original name or path because the file has been renamed to a random $R identifier at deletion time. The deletion timestamp is not stored in the MFT entry in a way that gives the original location. Therefore, the $MFT entry alone cannot provide the original path or deletion time needed for the analysis.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.