Welcome to the digital forensics training environment. In this module, you will analyze deleted artifacts to reconstruct a timeline of events. Enhance your forensic reasoning and prepare for the CHFI (312-49) examination.

CHFI (312-49) Digital Forensics Simulation

Investigation Scenario

Case Reference: #2026-BOS-044

Organization: Apex Code Dynamics (Software Development Firm, Boston)

Context: A senior developer resigned abruptly. Subsequent auditing suggested potential intellectual property theft. The suspect allegedly deleted proprietary source code from their assigned workstation prior to their departure. You have been authorized to conduct a digital forensics investigation to reconstruct the user's activity timeline and identify the deleted files.

Device Under Investigation: Desktop Workstation, OS: Windows 10 Enterprise (Build 19045).

Evidence Collected

A physical bit-stream image (E01) of the workstation's NVMe drive was acquired using write-blocking hardware. The NTFS file system was mounted for analysis. Examining the Master File Table (MFT) and the Recycle Bin directory, the following artifacts were observed:

PATH: C:\$Recycle.Bin\S-1-5-21-382902318-1932483-3928192-1001\ CONTENTS: Directory Listing: 10/09/2026 08:14 AM . 10/09/2026 08:14 AM .. 10/09/2026 08:12 AM 544 $IB3D9X1.zip 10/09/2026 08:12 AM 45,219,840 $RB3D9X1.zip 10/09/2026 08:14 AM 544 $I9P2K4M.docx 10/09/2026 08:14 AM 241,112 $R9P2K4M.docx MD5 ($IB3D9X1.zip): 4f8a2b... MD5 ($I9P2K4M.docx): 9c1d5e...

The forensic tool indicates these files were sent to the Recycle Bin, but the original paths and exact deletion timestamps are required for the official report.

Question

During a computer-forensics investigation at a software development company in Boston, an analyst discovers several files that appear to have been recently deleted from a suspect's Windows 10 workstation. To determine the original location, deletion time, and size of these files, which artifact in the Recycle Bin should the analyst examine?
Investigator's Hint: Consider the architecture changes in Windows. In Windows Vista and later (including Windows 10), when a file is deleted, two files are created. One contains the raw data, and the other (an index/information file) contains the metadata. Which prefix stands for "Information"?

Expert Analysis

1. What the Evidence Shows

The evidence reveals the contents of a user's Recycle Bin identified by their Security Identifier (SID). The presence of paired files starting with $I and $R confirms that files were deleted using the Windows Recycle Bin mechanism on a modern Windows operating system (Vista or later).

2. Forensic Stage

Examination and Analysis. The analyst is reviewing extracted artifacts to reconstruct the timeline and identify the origin of the deleted data.

3. Why the Correct Answer is Correct

A. $I file is correct. In Windows 10, the Recycle Bin mechanism creates two files for every deleted file. The $I (Information/Index) file is specifically structured to store metadata. Parsing this file reveals the original absolute file path, the file size, and the exact timestamp (in Windows FILETIME format) of when the file was moved to the Recycle Bin.

4. Why the Others are Wrong

  • B. $R file: The $R (Recovery/Raw) file contains the actual contents/data of the deleted file, not the metadata indicating where it came from or when it was deleted.
  • C. INFO2 file: This is a legacy artifact. Windows 98, 2000, and XP used a single hidden database file named INFO2 to store metadata for all deleted files. It is not present in Windows 10.
  • D. Metadata file: This is a generic, non-technical term. In a forensic investigation, you must identify the specific artifact name (the $I file).

5. Real-World Forensic Action

An investigator would export the $I files and use a tool like Zimmerman's RBCmd, Autopsy, or a hex editor to parse the binary structure. They would correlate the deletion timestamps found in the $I file with system logs (like USB connection logs) to determine if the source code was copied to an external drive prior to deletion.

MINI LESSON: $I File Structure

Understanding the exact byte structure of an artifact is crucial for manual verification. A Windows 10 $I file (Version 2) has a specific format:

  • Bytes 0-7: Version header (02 00 00 00 00 00 00 00)
  • Bytes 8-15: Deleted file size (in hex, little-endian)
  • Bytes 16-23: Deletion timestamp (Windows 64-bit FILETIME)
  • Bytes 24-27: Original file path length
  • Bytes 28+: Original file path (UTF-16LE Unicode string)

Chain of Custody: Never open $I files natively on your analysis machine without write-blockers or taking MD5/SHA256 hashes first, as OS interactions can alter metadata.

Ready for the next investigation?

Master digital forensics processes, artifact analysis, and incident investigation.

Explore more CHFI simulations