CHFI Storage Forensics and File System Analysis Practice Question
During a forensic investigation, you encounter a Windows system with an NTFS volume. The suspect claims they never used the recycle bin, but you find files in the $Recycle.bin folder. Which artifact can help you determine the original file path and deletion time?
⚠ Common exam trap
The CHFI exam often tests the misconception that the $MFT entry retains deletion metadata, but in NTFS, the $MFT entry for a deleted file is marked as free and its attributes are often cleared or reused, whereas the $I file in $Recycle.bin is the persistent artifact for original path and deletion time.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The $I file in the $Recycle.bin folder
The $I file in the $Recycle.bin folder stores metadata about the deleted file, including its original file path and the deletion timestamp. When a file is moved to the Recycle Bin, Windows creates an $I file (e.g., $I<random>.dat) containing this information, which can be parsed to recover the original location and deletion time. This makes it the direct artifact for the investigator's needs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The USN journal
Why it's wrong here
The USN change journal logs file system operations with reason flags such as USN_REASON_FILE_DELETE, but it stores only a file reference and the name relative to the immediate parent at the time of the change. It does not persistently preserve the full original path or the exact deletion timestamp, and if the parent directory is later renamed or deleted, the path becomes unreliable. Thus it is useful for activity tracing but not as a primary source for recovering original path and deletion time.
- ✗
The file slack space
Why it's wrong here
File slack consists of unused bytes between the logical end of a file and the end of its allocated cluster or sector. While slack may contain remnants of previously deleted files or data, it is raw unallocated space with no file system metadata. It cannot provide the original path, deletion timestamp, or parent directory information, so it is not a suitable source for recovering recycle bin metadata.
- ✓
The $I file in the $Recycle.bin folder
Why this is correct
When Windows moves a file to the Recycle Bin, it creates an $I file (paired with an $R content file) in the $Recycle.Bin folder. The $I file contains a header including the file size, the deletion timestamp in Windows FILETIME format, and the original full path stored as UTF-16LE. This makes the $I file the authoritative source for determining the original path and deletion time, even if the $R file's content has been overwritten.
- ✗
The $MFT entry for the deleted file
Why it's wrong here
The MFT entry for a deleted file is marked as unallocated and can be overwritten by any subsequent file creation or extension. Even when intact, an MFT entry stores only a filename and a parent file reference, requiring a directory tree walk to reconstruct the full original path. Because the $I file in the Recycle Bin is a dedicated metadata record that persists until the bin is emptied, the MFT entry is less reliable and not the primary source for path and deletion time.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 745 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.