EnCase Certified Examiner (EnCE) Practice Test

The correct answer is based on how Windows manages and organizes deleted files in the Recycle Bin. Specifically, the file containing the metadata for deleted files, including the date and time information about when a file was deleted, is stored in a file with a naming convention that includes the prefix "$I" followed by a unique identifier based on the deleted file's original name.

In the case of the Recycle Bin, the "$I" file contains information about the deleted file, which includes the file's original name, its path, size, and crucially, the date and time of deletion. This ensures that if a user restores the deleted file from the Recycle Bin, it can be restored to its original state with all the relevant attributes intact.

On the contrary, the "$R" prefixed file (like $R0F5B7C.docx) contains the actual data of the deleted file, but not the metadata you are interested in. The INFO2 file is a system-maintained file that used to keep track of Recycle Bin records on versions prior to Windows Vista; in Windows 7 and later, the information is maintained in the "$I" files. Finally, "deleted.ini" is not a standard or recognized component of