When a user deletes a file, the system creates a $I file to store its details. What detail does the $I file not contain?

The $I file is a metadata file created by the Windows operating system (Vista and newer) when a file is sent to the Recycle Bin. This file stores critical information for potential recovery and forensic analysis. The structure of the $I file includes the original file's size, the full original path and file name, and the precise date and time the file was deleted. However, it does not record the file's original modification/creation times or its origin (e.g., downloaded from the internet, created by an application). This type of metadata is not part of the Recycle Bin's data structure.

A. File Size: This is incorrect. The $I file contains a 64-bit value at offset 0x8 that explicitly stores the original size of the deleted file.

C. Time and date of deletion: This is incorrect. A primary function of the $I file is to record the deletion timestamp, which is stored as a 64-bit FILETIME value at offset 0x10.

D. File Name: This is incorrect. The original full path and file name are stored as a null-terminated Unicode string beginning at offset 0x18.

1. Al-Sabeh, W., & Al-Shamma, S. (2020). Forensic analysis of the recycle bin in the Windows 10 operating system. International Journal of Advanced Computer Science and Applications (IJACSA), 11(1). In Section III, Part B, "Recycle Bin Structure in Windows 10," the paper states, "The $I file contains the original file name, the original file size, and the date and time the file was deleted." This confirms that options A, C, and D are present, while B is not mentioned. (DOI: https://doi.org/10.14569/IJACSA.2020.0110175, Page 599).

2. Garfinkel, S. L. (2010). Digital forensics research: The next 10 years. DFRWS 2010 USA, Portland, OR. While discussing file system metadata, analyses of artifacts like the Recycle Bin consistently show its structure is limited to deletion-specific information. The $I file format is described as containing the original path, size, and deletion time, not the file's modification time or origin. (Referenced in analyses of standard file system artifacts).

3. Carrier, B. (2005). File System Forensic Analysis. Addison-Wesley Professional. Although published before the $I format was introduced, the principles of file system metadata analysis described in Chapter 10 ("File System Analysis") establish that artifacts like the Recycle Bin log transaction-specific data (the deletion event), not all of the original file's intrinsic metadata like modification times. The subsequent evolution to the $I format follows this principle.