>> what data should I capture?
> The file attributes are the only thing I can think of.

How should I capture these for a report?

> How did the folder get created in the first place?

By recovery of a backup of another system, using Acrinic True Image.