CHFI Storage Forensics and File System Analysis Practice Question
During a forensic examination, an analyst uses Autopsy to view the contents of the Recycle Bin on a Windows 10 system. However, some files that were deleted by the user do not appear in the Recycle Bin. What is the MOST likely reason?
⚠ Common exam trap
A common mix-up: candidates assume the Recycle Bin stores all deleted files, but the EC-Council CHFI exam tests the specific behavior that Shift+Delete bypasses the Recycle Bin entirely, and that emptying the Recycle Bin removes the files from view but does not explain their absence if they were never placed there.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The files were deleted using Shift+Delete
When a user deletes a file using Shift+Delete, the file bypasses the Recycle Bin entirely and is permanently removed from the file system. Autopsy, as a forensic tool, reads the Recycle Bin’s metadata (e.g., the $I and $R files) to list its contents, so files deleted with Shift+Delete will not appear there because they were never placed in the Recycle Bin.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Recycle Bin stores only files smaller than 1 GB
Why it's wrong here
The Recycle Bin's capacity is configured per volume as a percentage of available disk space (typically 10%) and is not a fixed 1 GB limit. While files larger than the Recycle Bin's maximum size can trigger a permanent-deletion warning, this is a quota-driven behavior, not a hardcoded 1 GB threshold. Therefore, a size limitation does not explain why the files never appeared in the Recycle Bin in this scenario.
- ✗
The files were encrypted
Why it's wrong here
Encryption, whether via EFS or full-volume BitLocker, operates at the file-system or volume layer and does not alter Windows' default delete semantics. When an encrypted file is deleted normally, it is moved into the Recycle Bin just like any other file, with the stored copy remaining encrypted. Thus, the presence of encryption cannot cause a file to bypass the Recycle Bin and does not explain the files' absence in this investigation.
- ✓
The files were deleted using Shift+Delete
Why this is correct
Holding Shift while pressing Delete (or selecting 'permanently delete') instructs the NTFS driver to unlink the file immediately without creating the $I metadata and $R data entries in the $Recycle.Bin folder. This bypasses the normal two-step Recycle Bin process, marking the clusters as free and removing the directory entry, so the file never appears in the Recycle Bin. In forensic practice, this is the classic explanation for why deleted files cannot be located in the Recycle Bin.
- ✗
The Recycle Bin was emptied
Why it's wrong here
If the Recycle Bin had been emptied, the files would first have been present as $I/$R pairs; emptying the bin removes them but often leaves residual artifacts, such as original filenames in $I files, data remnants, or entries in the NTFS USN change journal. The scenario indicates the files never appeared in the Recycle Bin from the outset, not that they were present and later purged. Therefore, an emptied Recycle Bin cannot account for the complete absence of any Recycle Bin entry in this case.
Go deeper
Related to this question
About these practice questions
One of 745 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.