When you delete a file you want to delete by right-clicking on it or by pressing the delete button, your file is not permanently deleted and is in the recycle bin. When you want to delete the file permanently, we delete it without sending it to the recycle bin (by pressing the shift+delete keys) or empty the recycle bin. For a crime scene investigator, mixing the trash at the crime scene can change the course of the event, as well as analyzing the recycling bin for forensic experts can change the course of the case by providing important evidence to the case.
Depending on the version of the Windows operating system, the recycle bin is kept in a different place. Recycle bin locations for all windows operating systems are explained below.
Windows 10/8/7
Bus
• C:\$Recycle.bin
•Every deleted recovery file with Delete Time and Original File names is here.
Tips
• SID number can be matched with registered user.
- deleted files are stored as “$I######”.
• original bus and name available.
• date and time of deletion are available.
Windows Vista
For Windows Vista+, the data is still stored under the user's SID, the parent folder is called "$Recycle.Bin". Windows no longer uses the INFO2 file and when a file is deleted, two files are created in the Recycle Bin. The first file starts with the value "$, R" followed by a random string(character). This file contains the actual content of the recycled file. The second file starts with "$, I" and ends with the same character as the file "$, R". This file contains the metadata for a particular file. The file “$, I” keeps the original filename, path, file size and deleted file.
Windows XP
In Windows XP, it is stored in the "recycler" folder under "C:\\". There is also some metadata about the recycled files and the INFO2 file, which contains a directory of all deleted files.
INFO2 File Review
Comments