CHFI Storage Forensics and File System Analysis Practice Question
An investigator needs to analyze the contents of the Windows Recycle Bin on a system running Windows 10. Which artifact(s) should the investigator examine to determine the original location and deletion time of a file in the Recycle Bin?
⚠ Common exam trap
EC-Council often tests the distinction between Windows 10's `$Recycle.Bin` folder with `$I`/`$R` files and the legacy `Recycled` folder with `INFO2` file, so candidates mistakenly choose the `INFO2` option for modern Windows systems.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The '$I' and '$R' files in the $Recycle.Bin\<SID> folder
In Windows 10, the Recycle Bin is implemented as the `$Recycle.Bin` folder, with each user having a subfolder identified by their Security Identifier (SID). When a file is deleted, it is renamed to an `$R` file (the actual data) and an `$I` file (metadata including original path and deletion timestamp) is created. Examining these `$I` and `$R` files allows the investigator to determine the original location and deletion time of the file.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The 'System Volume Information' folder
Why it's wrong here
The 'System Volume Information' folder is a protected NTFS system container that holds System Restore points, Volume Shadow Copy snapshots, and search indexes—none of which are Recycle Bin artifacts. It may allow recovery of previous versions of a file, but it does not store the per-item deletion metadata (original path, deletion time) that Windows 10 records for recycled files. Forensic examiners cannot use this folder to enumerate deleted items from the Recycle Bin.
- ✓
The '$I' and '$R' files in the $Recycle.Bin\<SID> folder
Why this is correct
In Windows 10, deleted files are stored under C:\$Recycle.Bin\<UserSID> as a pair of files with a shared random suffix: the $I file contains a binary structure—8-byte header, original file size, 64-bit FILETIME deletion timestamp, UTF-16 original path length, and the original absolute path—while the $R file retains the raw contents of the deleted object. Because the visible $R filename is a generated suffix, parsing the $I metadata is the only way to recover the original name and location; both files together allow full forensic reconstruction of the deletion.
- ✗
The 'INFO2' file in the Recycled folder
Why it's wrong here
INFO2 is the legacy Recycle Bin metadata index used in Windows 98, Me, 2000, and XP, located in the Recycled folder (or RECYCLER\<SID> on later NTFS versions). It stored fixed-format records with original file names, drive paths, deletion dates, and file sizes, but modern Windows 10 no longer creates INFO2; it relies exclusively on the $Recycle.Bin\<SID> structure with $I/$R files. An investigator encountering INFO2 today would be looking at artifacts from an obsolete OS or a drive previously used by one, not the current Windows 10 Recycle Bin.
- ✗
The 'desktop.ini' file in the Recycle Bin
Why it's wrong here
desktop.ini is a shell configuration file that controls folder appearance—display name, icon resource, and localized strings—and is present in the Recycle Bin as a standard Windows component. It contains no per-deletion records, no original file paths, no deletion timestamps, and does not change when items are added or removed from the Recycle Bin. Unlike the $I metadata file, it provides no evidence of what was deleted or when, and is irrelevant to Recycle Bin content analysis.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 745-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.