GCFA Windows Artifact Analysis Practice Question
An analyst is examining a Windows 10 system and finds a suspicious file in the Recycle Bin. The analyst wants to determine the original path of the file before it was deleted. Which artifact should the analyst examine to find the original file path and deletion time?
⚠ Common exam trap
The trap here is assuming that the $R file contains metadata, when in fact it only holds the file content, and the metadata is in the separate $I file.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
$I file
In Windows 10, each deleted file in the Recycle Bin has a corresponding $I file that stores the original path, deletion time, and file size. The $R file contains the actual data. The $Recycle.Bin folder is the container, and INFO2 is obsolete. Therefore, the $I file is the correct artifact to examine.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
INFO2 file
Why it's wrong here
INFO2 is a legacy file used in Windows XP and earlier to store Recycle Bin metadata. Windows 10 uses the $I files instead. Since the scenario specifies Windows 10, INFO2 is not present and would not contain the needed information. Thus, it is an incorrect artifact for this modern system.
- ✗
$Recycle.Bin folder
Why it's wrong here
The $Recycle.Bin folder is the directory that contains the $I and $R files for each user. It itself does not contain metadata about individual deleted files; it is just the container. Examining the folder alone will not reveal the original path or deletion time of a specific file. One must look inside at the $I files.
- ✓
$I file
Why this is correct
The $I file is a metadata file created alongside the $R file (which contains the actual deleted data) when a file is deleted to the Recycle Bin. It stores the original file path, the deletion timestamp, and the file size. Examining the $I file provides the original path and deletion time, directly answering the analyst's question.
- ✗
$R file
Why it's wrong here
The $R file contains the actual content of the deleted file. It does not store metadata such as the original path or deletion time. While it is useful for recovering file contents, it does not provide the information needed to determine where the file came from or when it was deleted. Therefore, it is not the correct artifact.
About these practice questions
This GCFA question is part of Courseiva's 292-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.